Use-After-Free Vulnerability in Linux Kernel's TCP Implementation

CVE-2026-80849

What is CVE-2026-80849?

A use-after-free vulnerability exists in the Linux kernel's TCP implementation, specifically affecting the handling of keys during TCP connections. When a socket is disconnected and a reconnect attempt is made to a different peer, the current key may point to freed memory, leading to potential data leakage or system instability. The vulnerability arises from improper synchronization in the kernel's handling of socket states and locking mechanisms, allowing for dangerous race conditions. The recommended mitigation includes incorporating a grace period before unlinking keys to ensure safe memory access during TCP connection operations.

References