CVE-2026-98432 – Unauthenticated Use-After-Free (DoS / Potential RCE) – Linux Kernel 4.4+ TCP Stack

Summary

CVE-2026-98432 is a use-after-free vulnerability (race condition) in the Linux kernel’s IPv4 TCP connection handling. A remote, unauthenticated attacker can trigger it by sending crafted IPv4 packets to a listening TCP socket during connection setup, which can crash the kernel or corrupt kernel memory. The CNA-supplied CVSS v3.1 base score is 9.8 (Critical). The flaw is in the kernel itself, not in any application, so any Linux host running an affected kernel with a reachable IPv4 TCP listener is in scope.

Technical details

• Root cause: use-after-free. Red Hat classifies it as CWE-825 (Expired Pointer Dereference); the CNA and NVD have not assigned a CWE. When a TCP connection is accepted, tcp_v4_syn_recv_sock() passes the request’s IP options (ireq_opt) to the new socket without copying them. The kernel then frees them with kfree() without waiting for other readers to finish, while another CPU processing a retransmitted SYN may still be reading them to build a SYN-ACK (ip_options_build()).
• Second trigger path: request-socket migration (net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program), where a cloned request socket shares the same options and frees them the same way.
• Trigger conditions: no authentication and no user interaction are required. According to the CVE record, the input is a TCP SYN carrying IPv4 Record Route or Timestamp options. There is no specific URL, endpoint or parameter involved. IPv6 is not affected by the main path.
• Attack vector: network.
• Impact: Red Hat describes the primary impact as a kernel crash (denial of service) or memory corruption, noting that reliable code execution requires precise heap control. A Go Security Team advisory (forwarded to oss-security) notes that an exploit described by Anthropic achieved remote code execution against a server with MPTCP listeners; the bug itself is not MPTCP-specific. Go 1.24 and later enable MPTCP on listening sockets by default.
• Exploitation status: a working exploit has been publicly described (Anthropic, October 27, 2026), but no public exploit code was found. At the time of writing, the sources reviewed did not report exploitation in the wild, and the CVE was not listed in CISA KEV.

Affected software

• Linux kernel 4.4 and later (introduced by commit 079096f103fa), up to the fixed releases below:
  • 5.10 branch before 5.10.272
  • 5.15 branch before 5.15.223
  • 6.1 branch before 6.1.190
  • 6.6 branch before 6.6.159
  • 6.12 branch before 6.12.113
  • 6.18 branch before 6.18.56
  • 7.2 branch before 7.2.10
  • Mainline before 7.3 (fix commit e3f33b0a1d89)
• End-of-life branches without a listed upstream fix remain affected unless the distribution backported the patch.
• Distribution kernels are affected according to their own backports. Check your vendor’s advisory (Red Hat, Debian, Ubuntu, SUSE, Oracle, Amazon Linux). Per Red Hat, RHEL 6 and RHEL 7 are not affected.
• Containers share the host kernel: patch the host or node image, not the container image. Appliances and embedded Linux devices (firewalls, VPN gateways, NAS, IoT) require a firmware update from their vendor. On managed platforms, the provider controls the kernel; follow the provider’s advisory.

Severity

• CVSS v3.1 base score (CNA): 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Red Hat lists the same score but marks it as preliminary. NVD had not completed its own analysis at the time of writing.

Mitigation and recommended actions

• Immediate: install your distribution’s fixed kernel package (or a kernel at or above the fixed versions listed above) and reboot into it, or apply a vendor livepatch where available.
• If you cannot patch immediately (these steps reduce exposure but do not remove the vulnerability):
  • Drop inbound IPv4 TCP packets carrying IP options, for example: iptables -t raw -I PREROUTING 1 -p tcp -m u32 --u32 '0>>24&0x0f=6:15' -j DROP (adapted from the AWS bulletin and limited to TCP so other traffic is not affected), or an equivalent rule on a network firewall in front of the host. Test before applying in production and make the rule persistent across reboots.
  • Disable MPTCP: sysctl -w net.mptcp.enabled=0, or set GODEBUG=multipathtcp=0 for Go 1.24+ services. This removes only the demonstrated exploit path; hosts without MPTCP listeners may still be vulnerable. The setting applies per network namespace, so it must also be set in each container or pod namespace, and it should be persisted in /etc/sysctl.d/.
• Prioritize internet-facing Linux hosts that terminate TCP connections themselves. Hosts reachable only through a proxy that terminates TCP (L7 or TLS load balancers, CDN, WAF) are at lower risk. Pass-through (L4) load balancers do not protect the backend host, so patch those hosts as well.

References

• CVE-2026-98432 at NIST
• CVE-2026-98432 CVE Record
• Go Security Team advisory (oss-security)
• Red Hat CVE page
• Red Hat Bugzilla 2553390
• AWS Security Bulletin 2026-160-AWS
• Debian Security Tracker
• Anthropic research write-up