News › security
By The Linux Camp News, November 1, 2026
CVE-2026-98432 exposes IPv4 TCP handshake processing to a remote memory-lifetime race. The fix preserves option data while readers finish; distribution package status matters more than the kernel base version.
Linux committed a fix for an IPv4 TCP socket-option use-after-free on October 5, 2026; Ubuntu records publication of CVE-2026-98432 on October 15. The patch addresses memory freed during concurrent connection-request processing, which Red Hat says a remote attacker can reach using specially timed network requests. These are patch and publication milestones, not documented discovery dates. 5 2 3
A request socket tracks a half-open TCP handshake before Linux creates the full connection socket. IPv4 hands the saved IP options to that child without copying them. Meanwhile, another CPU can process a retransmitted SYN and build a SYNACK reply using the same options. Request processing does not hold the listener lock, so the child can disappear and immediately free the options before that reader finishes. The resulting access to reclaimed memory is the use-after-free. 1 6 5
The repair changes both affected destructors to kfree_rcu(), deferring reclamation through an RCU grace period rather than freeing immediately. RCU is a synchronization mechanism that lets existing protected readers finish before memory is reclaimed; these readers already use it. The second destructor covers request migration enabled by net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program. There, an old request and its clone share option storage, and destroying the clone can invalidate a reader still using the old request. 5 6 2
As retrieved November 1, 2026, the official CVE record assigns CVSS 3.1 9.8 Critical. Red Hat separately assesses remote, unauthenticated kernel-memory corruption or an immediate system crash, without user interaction. That makes host availability an operational concern even without reliable code execution. The score is not an exploit demonstration: Red Hat says reliable arbitrary-code execution through this timing-sensitive race requires precise heap control. 7 3 1
The November 1 tracker retrievals show different distribution outcomes. Debian lists bookworm's linux 6.1.190-1 and trixie's 6.12.113-1 security packages as fixed, alongside bookworm's linux-6.12 6.12.113-1~deb12u1. Ubuntu's page, last revised October 30, marks its linux package vulnerable on releases 16.04 through 26.10, with work-in-progress versions for 22.04 and newer; 14.04 is marked not affected. A work-in-progress version is not a released-fix verdict. 4 2
Check the vendor's package status rather than declaring a kernel vulnerable from its base version: backports can preserve an older version while incorporating the repair. Also distinguish a fixed package installed on disk from the kernel actually running; Atlas reports that this fix takes effect after a reboot. For remediation, prefer a supported kernel package containing the fix over a local cherry-pick. The kernel CVE team explains that individual changes are tested as part of larger releases, not in isolation. 3 1 6
IPv6 avoids the first race because it duplicates the options, but the maintainer identifies a separate CALIPSO-related IPv6 migration problem requiring another patch. Nor should the first race be confused with ordinary SYNACK timer handling: the commit explicitly excludes that timer because reference holding and synchronous deletion protect the request. 5 6
Evidence of exploitation remains narrower than the severity assessment. Atlas attributes an unpublished remote-root demonstration against multipath TCP listeners to Anthropic; the supplied material does not include the researcher's original disclosure. The official CISA lookup retrieved November 1, using its October 30 catalog snapshot, contains no entry for this CVE. Neither that absence nor a research demonstration establishes whether exploitation has occurred in the wild. 1 8