External risk intelligence

Linux Kernel TCP Race Condition in tcp_ao_destroy_sock

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64459

This vulnerability exists deep within the Linux kernel TCP stack implementation (specifically TCP-AO). It requires a local unprivileged user to set up and trigger a specific race condition on a socket they control. It is not reachable via remote network requests from the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's TCP implementation could allow an attacker to manipulate network traffic, potentially leading to system instability or crashes. The issue arises from a race condition that affects how certain security-related information is handled during socket operations. While the technical details are complex, the core concern is a potential flaw in the kernel's network processing.

Kernel flaw impacts TCP security handling.
Leadership should track kernel updates for network security.
Confirm relevance and exposure for your Linux systems.

Attack Path

How an attacker could exploit the issue

An attacker could begin by setting up TCP options on a socket they control, then send specifically crafted network traffic to that socket. This interaction could trigger a race condition within the Linux kernel's TCP processing, leading to the kernel attempting to access memory that has already been freed. Such an access could crash the system and allow the attacker to execute code with the kernel's privileges.

Requires local, unprivileged access.
Triggered by specific network traffic and timing.
Risk of system crash and code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect system stability and lead to denial-of-service conditions when specific network operations are performed on TCP sockets, especially those using TCP-AO or TCP-MD5. An unprivileged local user could trigger a race condition in the kernel's TCP stack, potentially causing memory corruption and system crashes.

System stability and network services.
Local user triggering a race condition.
Denial-of-service or system crash.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Linux kernel's TCP implementation and requires a local unprivileged user to exploit a race condition. Infrastructure or platform teams managing Linux systems are likely responsible for addressing this. The first step is to identify all Linux systems, determine if they are running the affected kernel code, and assess their exposure, prioritizing critical or internet-facing systems.

Identify Linux systems and affected kernel code.
Verify local exploitability and business criticality.
Plan remediation based on system risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel's TCP-AO component?

The TCP Authentication Option (TCP-AO) is a networking mechanism within the Linux kernel designed to provide cryptographic authentication for TCP connections. It manages security keys and connection state to ensure communication integrity. This implementation tracks socket metadata, including authentication information, which must be carefully synchronized to prevent memory errors when sockets are destroyed or modified.

How does CVE-2026-64459 manifest as a vulnerability?

This vulnerability involves a race condition weakness known as a use-after-free. It occurs because the kernel prematurely releases memory for TCP-AO keys without maintaining an RCU grace period. During a socket connection attempt, one CPU may free this memory while another CPU concurrently attempts to access it to process incoming network traffic, leading to illegal memory access.

Can this vulnerability be triggered by remote network traffic?

No, the vulnerability is not reachable via remote, unsolicited network traffic. Triggering this race condition requires a local, unprivileged user to initiate specific socket operations, such as creating a socket with TCP-AO and TCP-MD5 options, and then deliberately inducing timing conflicts during the socket's connection setup phase.

How relevant is this flaw to my infrastructure security?

The Halo Surface Signal assessment classifies this as very unlikely for most environments. Because the flaw exists deep within the kernel's local TCP stack and necessitates specific local user actions and precise timing, it poses a low risk for remote exploitation, primarily impacting system availability if a local user attempts to trigger a crash.

What is the recommended operational response?

To address this, administrators should audit their Linux environments to identify kernels containing the vulnerable code. Prioritize patching systems that permit untrusted local users, as they are the primary threat vector. Monitor official kernel release channels for stable updates that restore proper RCU synchronization, and deploy these updates according to standard maintenance cycles.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.