{"api_version":"1","generated_at":"2026-08-22T02:35:55+00:00","cve":"CVE-2026-72139","urls":{"html":"https://cve.report/CVE-2026-72139","api":"https://cve.report/api/cve/CVE-2026-72139.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72139","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72139"},"summary":{"title":"tcp: defer md5sig_info kfree past RCU grace period in tcp_connect","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: defer md5sig_info kfree past RCU grace period in tcp_connect\n\nThe md5+ao reconciliation in tcp_connect() (net/ipv4/tcp_output.c)\nhas two symmetric branches:\n\n\tif (needs_md5) {\n\t\ttcp_ao_destroy_sock(sk, false);\n\t} else if (needs_ao) {\n\t\ttcp_clear_md5_list(sk);\n\t\tkfree(rcu_replace_pointer(tp->md5sig_info, NULL, ...));\n\t}\n\nBoth branches free a per-socket auth-info object while the socket is\nin TCP_SYN_SENT and is already on the inet ehash (inserted by\ninet_hash_connect() in tcp_v4_connect()). Both branches are reachable\nby softirq RX-path readers that load the corresponding info pointer\nvia implicit RCU before bh_lock_sock_nested() is taken.\n\nThe needs_md5 branch is fixed in the prior patch by re-introducing\nthe call_rcu() free in tcp_ao_destroy_sock(): the equivalent per-key\nloop runs inside tcp_ao_info_free_rcu(), the RCU callback, so by the\ntime it frees each tcp_ao_key all softirq readers that captured the\ncontainer have already completed rcu_read_unlock().\n\nThe needs_ao branch is not symmetric in the same way. The container\nfree can be deferred via kfree_rcu(md5sig, rcu) -- struct\ntcp_md5sig_info already has the required rcu member\n(include/net/tcp.h:1999-2002), and the rest of the tree already does\nthis in the tcp_md5sig_info_add() rollback paths\n(net/ipv4/tcp_ipv4.c:1410, 1436). But the per-key teardown is done\nby tcp_clear_md5_list() in process context BEFORE the container's\nRCU grace period: it walks &md5sig->head and frees each\ntcp_md5sig_key with bare hlist_del + kfree. A concurrent softirq\nreader in __tcp_md5_do_lookup() / __tcp_md5_do_lookup_exact()\n(tcp_ipv4.c:1253, 1298) walks the same list via\nhlist_for_each_entry_rcu() and races with that bare kfree on the\nkeys themselves -- a per-key slab use-after-free of the same class\nas the TCP-AO bug, on the same race window.\n\nFix this in two halves:\n\n  1. Convert the bare kfree() in tcp_connect() to kfree_rcu() so the\n     md5sig_info container joins the rest of the md5sig lifecycle.\n     The local-variable lift is mechanical and required because\n     kfree_rcu() is a macro that expects an lvalue.\n\n  2. Make tcp_clear_md5_list() RCU-safe by replacing hlist_del +\n     kfree(key) with hlist_del_rcu + kfree_rcu(key, rcu). struct\n     tcp_md5sig_key already carries the rcu member\n     (include/net/tcp.h:1995) and tcp_md5_do_del()\n     (net/ipv4/tcp_ipv4.c:1456) already uses kfree_rcu, so this\n     restores the lifecycle invariant the rest of the file follows\n     rather than introducing a one-off.\n\nThe other caller of tcp_clear_md5_list() is tcp_md5_destruct_sock()\n(net/ipv4/tcp.c:412), which runs from the sock destructor when the\nsocket is already unhashed and unreachable; the extra grace period\nthere is unnecessary but harmless. Making the helper unconditionally\nRCU-safe is the cleaner contract.\n\nThe needs_ao branch is not reachable by the userns reproducer used\nto demonstrate the AO-side splat (the repro installs both keys but\nends up in the needs_md5 branch because the connect peer matches\nthe MD5 key, not the AO key); however the symmetric race exists\nand a maintainer touching this code should not have to think about\nwhich branch escapes RCU and which one does not.\n\n[also credits to Qihang, who found that this races with tcp-diag]","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:21:31","updated_at":"2026-08-17 06:18:13"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/33a1bee413628378fd036a4f2b17ba86b0bc560c","name":"https://git.kernel.org/stable/c/33a1bee413628378fd036a4f2b17ba86b0bc560c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/da48b9bf1eb95a9cfd09d615ca58cfc2b03de369","name":"https://git.kernel.org/stable/c/da48b9bf1eb95a9cfd09d615ca58cfc2b03de369","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b74cd55038905d5e74c1de109ab78a30b2ea0e1f","name":"https://git.kernel.org/stable/c/b74cd55038905d5e74c1de109ab78a30b2ea0e1f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72139","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72139","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 51e547e8c89c661f6fbede4a28b1d33b13625683 33a1bee413628378fd036a4f2b17ba86b0bc560c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 51e547e8c89c661f6fbede4a28b1d33b13625683 da48b9bf1eb95a9cfd09d615ca58cfc2b03de369 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 51e547e8c89c661f6fbede4a28b1d33b13625683 b74cd55038905d5e74c1de109ab78a30b2ea0e1f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.18","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.40 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72139","cve":"CVE-2026-72139","epss":"0.005880000","percentile":"0.453330000","score_date":"2026-08-17","updated_at":"2026-08-18 00:11:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/tcp_ipv4.c","net/ipv4/tcp_output.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"33a1bee413628378fd036a4f2b17ba86b0bc560c","status":"affected","version":"51e547e8c89c661f6fbede4a28b1d33b13625683","versionType":"git"},{"lessThan":"da48b9bf1eb95a9cfd09d615ca58cfc2b03de369","status":"affected","version":"51e547e8c89c661f6fbede4a28b1d33b13625683","versionType":"git"},{"lessThan":"b74cd55038905d5e74c1de109ab78a30b2ea0e1f","status":"affected","version":"51e547e8c89c661f6fbede4a28b1d33b13625683","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/tcp_ipv4.c","net/ipv4/tcp_output.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.18"},{"lessThan":"6.18","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.40","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"6.18","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"6.18","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: defer md5sig_info kfree past RCU grace period in tcp_connect\n\nThe md5+ao reconciliation in tcp_connect() (net/ipv4/tcp_output.c)\nhas two symmetric branches:\n\n\tif (needs_md5) {\n\t\ttcp_ao_destroy_sock(sk, false);\n\t} else if (needs_ao) {\n\t\ttcp_clear_md5_list(sk);\n\t\tkfree(rcu_replace_pointer(tp->md5sig_info, NULL, ...));\n\t}\n\nBoth branches free a per-socket auth-info object while the socket is\nin TCP_SYN_SENT and is already on the inet ehash (inserted by\ninet_hash_connect() in tcp_v4_connect()). Both branches are reachable\nby softirq RX-path readers that load the corresponding info pointer\nvia implicit RCU before bh_lock_sock_nested() is taken.\n\nThe needs_md5 branch is fixed in the prior patch by re-introducing\nthe call_rcu() free in tcp_ao_destroy_sock(): the equivalent per-key\nloop runs inside tcp_ao_info_free_rcu(), the RCU callback, so by the\ntime it frees each tcp_ao_key all softirq readers that captured the\ncontainer have already completed rcu_read_unlock().\n\nThe needs_ao branch is not symmetric in the same way. The container\nfree can be deferred via kfree_rcu(md5sig, rcu) -- struct\ntcp_md5sig_info already has the required rcu member\n(include/net/tcp.h:1999-2002), and the rest of the tree already does\nthis in the tcp_md5sig_info_add() rollback paths\n(net/ipv4/tcp_ipv4.c:1410, 1436). But the per-key teardown is done\nby tcp_clear_md5_list() in process context BEFORE the container's\nRCU grace period: it walks &md5sig->head and frees each\ntcp_md5sig_key with bare hlist_del + kfree. A concurrent softirq\nreader in __tcp_md5_do_lookup() / __tcp_md5_do_lookup_exact()\n(tcp_ipv4.c:1253, 1298) walks the same list via\nhlist_for_each_entry_rcu() and races with that bare kfree on the\nkeys themselves -- a per-key slab use-after-free of the same class\nas the TCP-AO bug, on the same race window.\n\nFix this in two halves:\n\n  1. Convert the bare kfree() in tcp_connect() to kfree_rcu() so the\n     md5sig_info container joins the rest of the md5sig lifecycle.\n     The local-variable lift is mechanical and required because\n     kfree_rcu() is a macro that expects an lvalue.\n\n  2. Make tcp_clear_md5_list() RCU-safe by replacing hlist_del +\n     kfree(key) with hlist_del_rcu + kfree_rcu(key, rcu). struct\n     tcp_md5sig_key already carries the rcu member\n     (include/net/tcp.h:1995) and tcp_md5_do_del()\n     (net/ipv4/tcp_ipv4.c:1456) already uses kfree_rcu, so this\n     restores the lifecycle invariant the rest of the file follows\n     rather than introducing a one-off.\n\nThe other caller of tcp_clear_md5_list() is tcp_md5_destruct_sock()\n(net/ipv4/tcp.c:412), which runs from the sock destructor when the\nsocket is already unhashed and unreachable; the extra grace period\nthere is unnecessary but harmless. Making the helper unconditionally\nRCU-safe is the cleaner contract.\n\nThe needs_ao branch is not reachable by the userns reproducer used\nto demonstrate the AO-side splat (the repro installs both keys but\nends up in the needs_md5 branch because the connect peer matches\nthe MD5 key, not the AO key); however the symmetric race exists\nand a maintainer touching this code should not have to think about\nwhich branch escapes RCU and which one does not.\n\n[also credits to Qihang, who found that this races with tcp-diag]"}],"metrics":[{"cvssV3_1":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:N - The UAF is driven by a race between tcp_connect() freeing MD5 keys and softirq RX handlers (tcp_v4_rcv→tcp_inbound_hash→__tcp_md5_do_lookup) on an ehashed SYN_SENT socket; forged inbound TCP segments reach this path over the network, matching internet-facing BGP/TCP-AO peers.\nAC:L - The attacker controls both sides of the race by calling connect() while concurrently spraying TCP segments (raw sockets or as the remote peer) at the socket 4-tuple; no victim-dependent timing or memory layout is required beyond standard heap reuse inherent to slab UAF.\nPR:N - Exploitation needs no host root: a remote BGP/TCP peer can send segments during the victim's outbound connect, and the demonstrated userns repro uses only uid=1000 with CLONE_NEWUSER|CLONE_NEWNET caps to install TCP_MD5/TCP-AO keys and trigger the race.\nUI:N - No end-user action is required; the bug fires during automated connect() handling (e.g., BGP session establishment) concurrent with inbound packet processing, without anyone opening files or confirming prompts.\nS:U - Impact is confined to kernel memory integrity/availability on the affected host; it does not cross VM, container, or IOMMU security boundaries into another authority.\nC:H - Concurrent hlist_for_each_entry_rcu() over tcp_md5sig_key objects that are being kfree()'d is a slab use-after-free; freed key memory can be reallocated and read during RCU traversal, enabling kernel information disclosure.\nI:H - The per-key UAF corrupts RCU list traversal in softirq and allows attacker-influenced slab reuse, providing a standard path to heap grooming and arbitrary kernel write or control-flow hijack.\nA:H - The symmetric TCP-AO connect race in the same window produces kernel GPF/oops in softirq (KASAN wild-memory-access); this MD5-key UAF in the identical SYN_SENT/ehash race window can panic or hang the system."}]}],"providerMetadata":{"dateUpdated":"2026-08-17T05:40:48.870Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/33a1bee413628378fd036a4f2b17ba86b0bc560c"},{"url":"https://git.kernel.org/stable/c/da48b9bf1eb95a9cfd09d615ca58cfc2b03de369"},{"url":"https://git.kernel.org/stable/c/b74cd55038905d5e74c1de109ab78a30b2ea0e1f"}],"title":"tcp: defer md5sig_info kfree past RCU grace period in tcp_connect","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72139","datePublished":"2026-08-15T05:53:13.279Z","dateReserved":"2026-08-09T03:40:39.908Z","dateUpdated":"2026-08-17T05:40:48.870Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:21:31","lastModifiedDate":"2026-08-17 06:18:13","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72139","Ordinal":"1","Title":"tcp: defer md5sig_info kfree past RCU grace period in tcp_connec","CVE":"CVE-2026-72139","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72139","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: defer md5sig_info kfree past RCU grace period in tcp_connect\n\nThe md5+ao reconciliation in tcp_connect() (net/ipv4/tcp_output.c)\nhas two symmetric branches:\n\n\tif (needs_md5) {\n\t\ttcp_ao_destroy_sock(sk, false);\n\t} else if (needs_ao) {\n\t\ttcp_clear_md5_list(sk);\n\t\tkfree(rcu_replace_pointer(tp->md5sig_info, NULL, ...));\n\t}\n\nBoth branches free a per-socket auth-info object while the socket is\nin TCP_SYN_SENT and is already on the inet ehash (inserted by\ninet_hash_connect() in tcp_v4_connect()). Both branches are reachable\nby softirq RX-path readers that load the corresponding info pointer\nvia implicit RCU before bh_lock_sock_nested() is taken.\n\nThe needs_md5 branch is fixed in the prior patch by re-introducing\nthe call_rcu() free in tcp_ao_destroy_sock(): the equivalent per-key\nloop runs inside tcp_ao_info_free_rcu(), the RCU callback, so by the\ntime it frees each tcp_ao_key all softirq readers that captured the\ncontainer have already completed rcu_read_unlock().\n\nThe needs_ao branch is not symmetric in the same way. The container\nfree can be deferred via kfree_rcu(md5sig, rcu) -- struct\ntcp_md5sig_info already has the required rcu member\n(include/net/tcp.h:1999-2002), and the rest of the tree already does\nthis in the tcp_md5sig_info_add() rollback paths\n(net/ipv4/tcp_ipv4.c:1410, 1436). But the per-key teardown is done\nby tcp_clear_md5_list() in process context BEFORE the container's\nRCU grace period: it walks &md5sig->head and frees each\ntcp_md5sig_key with bare hlist_del + kfree. A concurrent softirq\nreader in __tcp_md5_do_lookup() / __tcp_md5_do_lookup_exact()\n(tcp_ipv4.c:1253, 1298) walks the same list via\nhlist_for_each_entry_rcu() and races with that bare kfree on the\nkeys themselves -- a per-key slab use-after-free of the same class\nas the TCP-AO bug, on the same race window.\n\nFix this in two halves:\n\n  1. Convert the bare kfree() in tcp_connect() to kfree_rcu() so the\n     md5sig_info container joins the rest of the md5sig lifecycle.\n     The local-variable lift is mechanical and required because\n     kfree_rcu() is a macro that expects an lvalue.\n\n  2. Make tcp_clear_md5_list() RCU-safe by replacing hlist_del +\n     kfree(key) with hlist_del_rcu + kfree_rcu(key, rcu). struct\n     tcp_md5sig_key already carries the rcu member\n     (include/net/tcp.h:1995) and tcp_md5_do_del()\n     (net/ipv4/tcp_ipv4.c:1456) already uses kfree_rcu, so this\n     restores the lifecycle invariant the rest of the file follows\n     rather than introducing a one-off.\n\nThe other caller of tcp_clear_md5_list() is tcp_md5_destruct_sock()\n(net/ipv4/tcp.c:412), which runs from the sock destructor when the\nsocket is already unhashed and unreachable; the extra grace period\nthere is unnecessary but harmless. Making the helper unconditionally\nRCU-safe is the cleaner contract.\n\nThe needs_ao branch is not reachable by the userns reproducer used\nto demonstrate the AO-side splat (the repro installs both keys but\nends up in the needs_md5 branch because the connect peer matches\nthe MD5 key, not the AO key); however the symmetric race exists\nand a maintainer touching this code should not have to think about\nwhich branch escapes RCU and which one does not.\n\n[also credits to Qihang, who found that this races with tcp-diag]","Type":"Description","Title":"tcp: defer md5sig_info kfree past RCU grace period in tcp_connec"}]}}}