Linux kernel: Use-after-free in IPv4 TCP handshake IP options
Summary
A flaw in the IPv4 TCP handshake code of the Linux kernel allows a use-after-free of IP options on a TCP child socket. A retransmitted SYN processed on another CPU can trigger the bug while a SYN-ACK is still being built. The CVSS base score is 9.8 (Critical); the CVE record does not describe an authentication requirement for the trigger path, and the risk is greatest on exposed TCP listeners.
Affected
- Linux kernel from commit 079096f103fa (introduced in 4.4) until the fixed stable versions listed below
- Unaffected according to the CVE record: versions before 4.4 and the fixed stable branches
- Distribution kernels differ; the status of each distribution must be checked on its vendor advisory
Fixed in
- Upstream stable branches: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3 or later
- Distribution kernel versions: check the advisory of your vendor (e.g. Debian, SUSE, Oracle Linux, Amazon Linux, Ubuntu, Red Hat); status reported by secondary sources is inconsistent
- Upstream fix commit: e3f33b0a1d89d738e2b913dab519226eaf76e15b
Workaround
- Unknown. No vendor-documented workaround is available.
- Setting net.ipv4.tcp_migrate_req is named as a trigger path, but no vendor has documented it as a mitigation; do not change it without written confirmation from your distribution.
Exploitation
- No confirmed exploitation in the wild reported as of the research date (30 October 2026).
- Not known to be listed in CISA's Known Exploited Vulnerabilities catalog as of that date.
Our recommendation
- Identify all Linux systems with a kernel from 4.4 onward that accept inbound TCP connections, including appliances and virtual machines.
- Install the kernel update from your distribution as soon as it is available and reboot the system.
- Until a fix is installed, restrict exposure of TCP services and monitor your vendor's advisory for updates.
- Monitor for unusual kernel crashes or repeated SYN traffic on critical services.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (25 repositories)
Quaerendir/cve-2026-98432-audit · suominen/CVE-2026-98432 · nsrg-fmlorg/kpatch-cve-2026-98432 · typhoon1217/cve-2026-98432-mitigation · axisops/CVE-2026-98432
Research sources
- Upstream fix commit e3f33b0a1d89d738e2b913dab519226eaf76e15b git.kernel.org
- GitHub Security Advisory GHSA-qp6h-4hvh-qqqc github.com
- Debian Security Tracker CVE-2026-98432 security-tracker.debian.org
- Red Hat Bugzilla tracking bug 2553390 bugzilla.redhat.com
- The Hacker News: Linux kernel TCP flaw with 9.8 CVSS thehackernews.com
- oss-security mailing list post www.openwall.com
- CIRCL CVE record CVE-2026-98432 cve.circl.lu
- Ubuntu and RHEL fix status analysis (Aviatrix) aviatrix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:48.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build(). A similar issue exists with request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler() clones the request socket with inet_reqsk_clone(), so that the old request socket and its clone share the same ireq_opt, then reqsk_migrate_reset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcp_v4_syn_recv_sock()) when the clone is freed, and tcp_v4_reqsk_destructor() also uses a plain kfree(). Readers already use RCU, and other paths replacing inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor() as well. IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options. tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is only set by CALIPSO. This will be addressed in a separate patch.
NVD references (11)
- https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568
- https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936
- https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a
- https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036
- https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5
- https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2
- https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6
- https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b
- http://www.openwall.com/lists/oss-security/2026/10/30/1
- http://www.openwall.com/lists/oss-security/2026/10/30/6
- http://www.openwall.com/lists/oss-security/2026/10/31/5
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.