On Mon, 22 Jun 2026 18:52:46 +0000 Eric Dumazet wrote:

This series fixes a TCP-AO key lookup precedence bug.

TCP-AO stores MKTs in an unsorted list and returns the first match. This
allows newer, less-specific keys (wildcard VRF or shorter prefixes) to
shadow older, more-specific keys if inserted later.

Fix this by implementing sorted insertion in tcp_ao_link_mkt() based on
key specificity (VRF binding, then prefix length). This keeps the RX
lookup path fast while ensuring correctness.

The second patch adds a selftest to verify this behavior.

Unhappiness:

https://netdev-ctrl.bots.linux.dev/logs/vmksft/net-extra/results/702701/29-key-management-ipv4/stdout