Karen IT Security Response Center (KSRC) Advisory

Advisory ID: KSRC-2026-10301 | Publication Date: 30 October 2026

Critical Use-After-Free Vulnerability in Linux Kernel IPv4 TCP Stack
CVE-2026-98432

Summary

A critical use-after-free vulnerability has been identified in the Linux kernel’s IPv4 TCP implementation. The flaw, tracked as CVE-2026-98432, has been assigned a CVSS v3.1 score of 9.8 (Critical) by the Linux kernel CNA.

An unauthenticated remote attacker can trigger a race condition during TCP connection establishment by sending crafted SYN packets containing IPv4 options. Successful exploitation may lead to kernel memory corruption, information disclosure, denial of service, or in certain configurations, remote code execution with root privileges.

Technical Overview

The vulnerability exists in the handling of IP options during the TCP handshake. In tcp_v4_syn_recv_sock(), ownership of ireq->ireq_opt is transferred to the newly created child socket without proper copying or RCU protection. Concurrent processing of a retransmitted SYN on another CPU can access the memory after it has been freed, resulting in a use-after-free condition in ip_options_build().

The issue affects Linux kernels from version 4.4 onward that include the relevant networking changes. Upstream fixes have been released in multiple stable branches.

Affected Systems

• Linux kernel 4.4 and later (prior to fixed versions)
• Fixed upstream in: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3
• Distribution status (as of 30 October 2026):
  • Debian: Fixed
  • Oracle Linux: Fixed
  • Amazon Linux: Partially fixed
  • Ubuntu: Fixes still in progress for most supported releases
  • RHEL: Fix currently deferred

Recommendations

1. Immediate Action: Upgrade to a fixed kernel version as soon as it becomes available for your distribution.
2. Monitor your distribution’s security advisories closely (especially Ubuntu and RHEL users).
3. Where possible, prioritize systems that expose TCP services to untrusted networks.
4. After applying the kernel update, reboot the system to ensure the new kernel is loaded.
5. Until patches are available, limit exposure of TCP listeners to trusted networks where feasible.

Organizations should treat this vulnerability with high priority due to its remote unauthenticated nature and critical severity rating.

Karen IT
We make the Internet harder to abuse.