{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-72139",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-72139",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-08-15T05:53:13.279Z",
    "updatedAt": "2026-08-17T05:40:48.870Z",
    "importedAt": "2026-10-24T01:58:25.636Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "tcp: defer md5sig_info kfree past RCU grace period in tcp_connect",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: defer md5sig_info kfree past RCU grace period in tcp_connect\n\nThe md5+ao reconciliation in tcp_connect() (net/ipv4/tcp_output.c)\nhas two symmetric branches:\n\n\tif (needs_md5) {\n\t\ttcp_ao_destroy_sock(sk, false);\n\t} else if (needs_ao) {\n\t\ttcp_clear_md5_list(sk);\n\t\tkfree(rcu_replace_pointer(tp->md5sig_info, NULL, ...));\n\t}\n\nBoth branches free a per-socket auth-info object while the socket is\nin TCP_SYN_SENT and is already on the inet ehash (inserted by\ninet_hash_connect() in tcp_v4_connect()). Both branches are reachable\nby softirq RX-path readers that load the corresponding info pointer\nvia implicit RCU before bh_lock_sock_nested() is taken.\n\nThe needs_md5 branch is fixed in the prior patch by re-introducing\nthe call_rcu() free in tcp_ao_destroy_sock(): the equivalent per-key\nloop runs inside tcp_ao_info_free_rcu(), the RCU callback, so by the\ntime it frees each tcp_ao_key all softirq readers that captured the\ncontainer have already completed rcu_read_unlock().\n\nThe needs_ao branch is not symmetric in the same way. The container\nfree can be deferred via kfree_rcu(md5sig, rcu) -- struct\ntcp_md5sig_info already has the required rcu member\n(include/net/tcp.h:1999-2002), and the rest of the tree already does\nthis in the tcp_md5sig_info_add() rollback paths\n(net/ipv4/tcp_ipv4.c:1410, 1436). But the per-key teardown is done\nby tcp_clear_md5_list() in process context BEFORE the container's\nRCU grace period: it walks &md5sig->head and frees each\ntcp_md5sig_key with bare hlist_del + kfree. A concurrent softirq\nreader in __tcp_md5_do_lookup() / __tcp_md5_do_lookup_exact()\n(tcp_ipv4.c:1253, 1298) walks the same list via\nhlist_for_each_entry_rcu() and races with that bare kfree on the\nkeys themselves -- a per-key slab use-after-free of the same class\nas the TCP-AO bug, on the same race window.\n\nFix this in two halves:\n\n  1. Convert the bare kfree() in tcp_connect() to kfree_rcu() so the\n     md5sig_info container joins the rest of the md5sig lifecycle.\n     The local-variable lift is mechanical and required because\n     kfree_rcu() is a macro that expects an lvalue.\n\n  2. Make tcp_clear_md5_list() RCU-safe by replacing hlist_del +\n     kfree(key) with hlist_del_rcu + kfree_rcu(key, rcu). struct\n     tcp_md5sig_key already carries the rcu member\n     (include/net/tcp.h:1995) and tcp_md5_do_del()\n     (net/ipv4/tcp_ipv4.c:1456) already uses kfree_rcu, so this\n     restores the lifecycle invariant the rest of the file follows\n     rather than introducing a one-off.\n\nThe other caller of tcp_clear_md5_list() is tcp_md5_destruct_sock()\n(net/ipv4/tcp.c:412), which runs from the sock destructor when the\nsocket is already unhashed and unreachable; the extra grace period\nthere is unnecessary but harmless. Making the helper unconditionally\nRCU-safe is the cleaner contract.\n\nThe needs_ao branch is not reachable by the userns reproducer used\nto demonstrate the AO-side splat (the repro installs both keys but\nends up in the needs_md5 branch because the connect peer matches\nthe MD5 key, not the AO key); however the symmetric race exists\nand a maintainer touching this code should not have to think about\nwhich branch escapes RCU and which one does not.\n\n[also credits to Qihang, who found that this races with tcp-diag]",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "51e547e8c89c661f6fbede4a28b1d33b13625683",
              "status": "affected",
              "versionType": "git",
              "lessThan": "33a1bee413628378fd036a4f2b17ba86b0bc560c"
            },
            {
              "version": "51e547e8c89c661f6fbede4a28b1d33b13625683",
              "status": "affected",
              "versionType": "git",
              "lessThan": "da48b9bf1eb95a9cfd09d615ca58cfc2b03de369"
            },
            {
              "version": "51e547e8c89c661f6fbede4a28b1d33b13625683",
              "status": "affected",
              "versionType": "git",
              "lessThan": "b74cd55038905d5e74c1de109ab78a30b2ea0e1f"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.18",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.18"
            },
            {
              "version": "6.18.40",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.1.5",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "version": "7.2",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}