The vulnerability is a use‑after‑free in the Linux kernel’s TCP‑AO path. When a socket is created with TCP‑AO enabled and the device bound to a VRF is detached between initial validation and subsequent L3‑master recalculation, the kernel removes what it believes is the only AO key and frees the AO info structure. A reader can then hold a stale pointer to the freed structure and perform a write that corrupts kernel memory. This defect can trigger a kernel OOPS or, if an attacker controls the data written, it could be leveraged to execute arbitrary code in kernel mode. The documented reproducer shows a KASAN hit; in a production kernel the consequence would typically be a crash or, in a worst‑case, a privilege‑escalation vector.

All Linux kernel versions prior to the commit that implements the fix in tcp_ao_connect_init() are impacted. The fix applies to all mainstream distributions that use the upstream kernel. The vendor and product are Linux:Linux, indicating the Linux kernel across all platforms.

The CVSS score is not supplied and EPSS is unavailable, so the risk can be considered moderate. The bug requires a local user to orchestrate a race by creating a user and network namespace and detaching a veth device from a VRF while TCP‑AO connections are being made. The attack vector is a local, authenticated exploit. Because it relies on a specific configuration (TCP‑AO enabled, VRF detachable), exploitation is not trivial but could be achievable by an attacker who can bind VRF devices or runs privileged processes. It is not listed in the CISA KEV catalog, suggesting no widespread exploitation has been reported yet.