CVE-2026-98432: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98432 is a use-after-free vulnerability in the Linux kernel's IPv4 TCP stack, specifically in the handling of inet_opt and ireq_opt memory during TCP connection establishment. The flaw arises because tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to a child socket without copying it, while a concurrent CPU may still be reading that memory when building a SYNACK. The vulnerability affects the Linux kernel from version 4.4 onward (introduced by commit 079096f103fa), and is estimated as HIGH severity by Feedly's CVSS category estimate (Feedly, Linux Kernel CVE Announce).

The root cause is a race condition (CWE-416: Use After Free) in the Linux kernel's TCP/IPv4 implementation. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, allowing a child socket to be freed while a SYNACK is still being constructed on another CPU. tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, but inet_sock_destruct() frees inet_opt with a plain kfree() — without an RCU grace period — leading to a use-after-free in ip_options_build(). A similar race exists with request socket migration when net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is in use, as reqsk_timer_handler() clones the request socket via inet_reqsk_clone(), causing the old and cloned sockets to share the same ireq_opt pointer (Feedly, Linux Kernel CVE Announce).

Successful exploitation of this use-after-free vulnerability can lead to kernel memory corruption, potentially resulting in a system crash (denial of service) or, in more sophisticated scenarios, privilege escalation or arbitrary code execution in kernel context. The vulnerability is triggered during normal TCP SYN/SYNACK processing, meaning any system accepting TCP connections with IPv4 options enabled could be affected. Systems with net.ipv4.tcp_migrate_req=1 or custom BPF socket programs are at elevated risk due to the additional code path exposed (Feedly).

As of the disclosure date (October 15, 2026), no public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-98432 (Feedly). The vulnerability requires the ability to send TCP SYN packets to a listening socket on the target system, which is a low-privilege, network-accessible precondition. The race condition nature of the bug makes reliable exploitation complex. No CISA KEV catalog entry or threat actor attribution has been identified at this time.

Fixed versions are available across all supported stable kernel branches: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7 (upstream fix commit e3f33b0a1d89d738e2b913dab519226eaf76e15b). Users should update to the patched kernel version for their distribution as soon as possible. As a temporary workaround, disabling TCP request socket migration (sysctl -w net.ipv4.tcp_migrate_req=0) reduces one of the vulnerable code paths, though it does not fully mitigate the primary race condition (Feedly, Linux Kernel CVE Announce).