CVE-2026-98432: Linux TCP Use-After-Free and Patch Validation

CVE-2026-98432 is a use-after-free in the Linux kernel IPv4 TCP handshake path. The flaw can leave a stale pointer to an IP options object when request and child sockets interact across CPUs. Defenders should treat the upstream record, vendor scores, and MPTCP research as complementary evidence.

How the vulnerable path works

During a server handshake, tcp_v4_syn_recv_sock() transfers a request socket's ireq_opt pointer to the new child socket as inet_opt without copying it. A second CPU processing a retransmitted SYN can read those options under RCU while the child path frees them with ordinary kfree(). The upstream fix uses kfree_rcu() in relevant destructors so reclamation waits for an RCU grace period. A related case arises when request migration clones a request socket, allowing two objects to share one options allocation; the correction changes inet_sock_destruct() and tcp_v4_reqsk_destructor() for that case.

Severity, scope, and limits

The Linux CNA record assigns CVSS 3.1 9.8, while Ubuntu also publishes a CVSS 4.0 assessment of 8.3. Anthropic demonstrated unauthenticated root command execution against a controlled server with an MPTCP listener, but that does not prove universal compromise of every Linux TCP listener. Distribution assessments must be read against their own products and metric versions.

Response and validation

Administrators should identify reachable Linux TCP services, determine the vendor kernel actually running, install the vendor-provided fixed build, reboot, and retain evidence that the correction is active. AlmaLinux status could not be independently confirmed from a CVE-specific official advisory in the October 30, 2026 snapshot, while Ubuntu publishes a live package tracker. Disabling MPTCP reduces exposure but does not remove the underlying IPv4 lifetime bug.

Version checks

Upstream stable fixes include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and the 7.3 development line. These numbers are useful for upstream kernels, but vendor packages may backport fixes while keeping older base versions, so package status must be checked against the exact distribution release and kernel flavor.

Sources: penligent.ai