CVE-2026-98432 is a use-after-free in the Linux IPv4 TCP handshake, scored CVSS 3.1 9.8 by the kernel’s own CNA (AV:N/AC:L/PR:N/UI:N). Network reachable, no credentials, no user interaction, and it fires in the kernel before any application sees the connection. Published October 15. The bug goes back to 4.4.
The mechanism is a classic ownership screwup. tcp_v4_syn_recv_sock() hands the request socket’s ireq_opt (saved IPv4 options) to the child socket without copying it. A retransmitted SYN on another CPU can make tcp_check_req() send a SYNACK that reads those same options under rcu_read_lock() only. Meanwhile the child socket dies and inet_sock_destruct() frees inet_opt with a plain kfree(). Since the commit that installed syn_recv requests into the ehash table, request sockets run without the listener lock, so nothing stops the free from landing mid-read in ip_options_build(). Request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program) has the same shape through inet_reqsk_clone().
The fix is four lines: Eric Dumazet’s patch swaps the plain frees for kfree_rcu(), so the memory outlives every reader. Other paths that replace these options were already doing that. This is the part where I’d normally rant about how RCU rules have been the same since 2002 and people still get them wrong. I’ll skip it. The race is nasty, and a lost race only fails the handshake, so an attacker can retry as long as they like.
Fixed upstream releases: 7.2.10 and 6.18.56 (October 11), 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272 (October 15), and 7.3 (October 18). Anything from 4.4 through 5.4 is end-of-life upstream, so you are on distro backports or you are on nothing.
Per Atlas’s tracker survey as of November 1:
- Debian: fixed in 12 and 13, plus unstable.
- SUSE: SLES 16.0 and the 15 SP4 to SP6 LTSS kernels fixed, SP7 in progress.
- Amazon Linux: 2 and 2023 kernels all fixed.
- Oracle: UEK errata out since October 16.
- AlmaLinux: fixed kernels sitting in testing, not production.
- Ubuntu: “Vulnerable” on every release, no notice published. Sixteen days after disclosure.
Atlas also reports that Anthropic, whose researcher reported the bug, says it built a working root exploit against servers with a multipath TCP listener, and hasn’t released it. I can’t verify that claim and neither can you. Treat it as a reason not to wait, not as a fact about your exposure. NVD itself still shows the record as received with no analysis of its own.
Containers don’t help here. A container runs on the host’s kernel, so a fresh image fixes nothing. IPv6 is not affected by the main issue, per the commit.
What to do: check uname -r against the list above, or your distro’s tracker, since backports carry their own version numbers. Patch and reboot. If you run FreeBSD or OpenBSD, none of this is your problem, and you may enjoy that for a moment. Everyone else, see the kernel and security hub for why CVSS 9.8 doesn’t always mean your 9.8, and then ignore that advice this time. A remote, unauthenticated kernel bug in the accept path is the real thing.