CVE-2026-98432: Critical Linux Kernel Use-After-Free in IPv4 TCP — What It Is and How to Fix It
A critical vulnerability in the Linux kernel (CVE-2026-98432) has drawn significant attention. Rated 9.8 (Critical) by the Linux kernel CVE team and marked High priority by Ubuntu, it involves a use-after-free race condition in IPv4 TCP option handling.
As of late October 2026, fixed packages are available on several distributions including Debian, Oracle Linux, parts of Amazon Linux, openSUSE Leap 16.0, and SUSE Linux Micro 6.2. Ubuntu still lists supported releases as vulnerable with fixes in progress, while Red Hat has deferred its fix. A research demonstration (involving Anthropic’s Claude) reportedly produced a laboratory remote-root exploit under specific conditions, underscoring the need for prompt action once patches arrive.
What Is CVE-2026-98432?
The bug lives in the IPv4 TCP handshake code. When the kernel creates a new child socket from a request socket (tcp_v4_syn_recv_sock()), it transfers ownership of the IP options (ireq->ireq_opt → newinet->inet_opt) without copying them.
A concurrent CPU can process a retransmitted SYN for the same request socket and build a SYNACK (tcp_v4_send_synack() → ip_options_build()). Because the options are freed with a plain kfree() (no RCU grace period) when the child socket is destroyed, this creates a classic use-after-free. A related path exists with TCP request-socket migration (net.ipv4.tcp_migrate_req=1 or certain BPF programs).
IPv6 is largely unaffected by the primary issue (options are duplicated), though a similar migration problem exists for CALIPSO and is addressed separately.
The flaw has been present since roughly Linux 4.4. Upstream fixed it by switching to kfree_rcu() in the relevant destructors (commit e3f33b0a1d89...). Stable kernels that include the fix include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and mainline 7.3+.
Impact and Exploitability
- Remote, unauthenticated network attack surface (TCP connections).
- Potential outcomes: kernel crash / denial of service, memory corruption, or (in advanced cases) privilege escalation to root.
- Winning the race is non-trivial, which is why some vendors score it lower (e.g., SUSE and Oracle 8.1, Red Hat ~5.9–8.1, Amazon 7.0). Ubuntu and the kernel CNA use the 9.8 score.
- No confirmed widespread in-the-wild exploitation has been reported as of this writing, and it is not listed in CISA’s KEV catalog. However, a public research demonstration of a zero-click remote-root chain (particularly effective against multipath TCP listeners) raises the urgency.
Any system accepting TCP connections on a vulnerable kernel is potentially exposed—servers, cloud instances, containers sharing the host kernel, etc.
Current Status (as of 29 October 2026)
| Distribution | Status | Notes / Fixed Version |
|---|---|---|
| Ubuntu 22.04 / 24.04 / 26.04 / 26.10 | Vulnerable – fix in progress | Target versions exist but not yet released |
| Ubuntu 16.04 / 18.04 / 20.04 | Vulnerable | No fix date announced |
| Debian 12 (bookworm) / 13 (trixie) | Fixed | 6.1.190-1 / 6.12.113-1 |
| Oracle Linux (UEK) | Fixed | Multiple ELSA advisories |
| Amazon Linux 2023 (some kernels) | Partially fixed | kernel 6.18 and 6.12 fixed; others pending |
| openSUSE Leap 16.0 | Fixed | kernel 6.12.0-160000.40.1 or later |
| SUSE Linux Micro 6.2 | Fixed | kernel 6.12.0-160000.40.1 or later |
| SLES 15 SP4–SP6 LTSS / SLES 16.0 | Fixed or in progress | See SUSE advisories (e.g. SUSE-SU-2026:24386-1) |
| RHEL 8/9/10 + OpenShift | Fix deferred | No released packages yet |
Always check the official trackers (Ubuntu CVE page, SUSE CVE page, etc.) for the latest package status, as this changes quickly.
How to Check If You Are Affected
- Identify your running kernel:
uname -r - On Ubuntu:
dpkg -l | grep linux-imageThen match against https://ubuntu.com/security/CVE-2026-98432. - On openSUSE / SUSE:
rpm -q kernel-default # or zypper se -s kernel-defaultCompare against the fixed version (e.g. 6.12.0-160000.40.1+). - Monitor for available updates on your distribution.
Steps to Fix the Vulnerability
Primary fix: Install the patched kernel and reboot.
On Ubuntu (once packages are published)
sudo apt update
sudo apt full-upgrade
sudo rebootOn Debian
sudo apt update
sudo apt full-upgrade
sudo rebootOn openSUSE Leap / SUSE Linux Enterprise / SUSE Linux Micro
sudo zypper refresh
sudo zypper update
# or more specifically:
sudo zypper in -t patch openSUSE-... # follow the exact patch name from the advisory
# or
sudo zypper up kernel-default
sudo rebootFor openSUSE Leap 16.0 and SUSE Linux Micro 6.2 the fixed kernel is 6.12.0-160000.40.1 (or later). After updating, confirm with uname -r.
On RHEL / AlmaLinux / Rocky / Oracle (when available)
sudo dnf update kernel
sudo rebootImportant: The vulnerability is fixed only after the system is running the patched kernel. Simply installing the package is not enough—reboot is mandatory.
Temporary Mitigations (While Waiting for Patches)
These reduce attack surface but do not fully eliminate the primary race:
- Disable TCP request-socket migration:
sudo sysctl -w net.ipv4.tcp_migrate_req=0Make it persistent by adding the line to/etc/sysctl.d/99-tcp-migrate.conf(or similar) and runningsysctl --system. - Limit exposure of TCP services to untrusted networks (firewall rules, security groups, reverse proxies).
- Prefer IPv6-only listeners where feasible (the primary path is IPv4-specific).
- Avoid enabling multipath TCP (MPTCP) on publicly reachable services if not required.
These are stop-gaps only. The real solution is the kernel update.
Best Practices Going Forward
- Subscribe to your distribution’s security notices (Ubuntu USN, SUSE Security Advisories, etc.).
- Enable automatic security updates where appropriate, but treat kernel updates carefully (test first in non-production).
- Maintain an inventory of kernel versions across your fleet (especially cloud instances and containers).
- For high-security environments, consider live-patching solutions once they support this CVE, though a full reboot remains the cleanest approach for kernel fixes of this type.
Conclusion
CVE-2026-98432 is a serious race-condition use-after-free in a core networking path. While reliable remote exploitation is non-trivial, the combination of a 9.8 CVSS score, network reachability without authentication, and demonstrated research exploits makes it high priority.
Monitor the official trackers closely. As soon as fixed kernel packages appear for your release (already available for openSUSE Leap 16.0, SUSE Linux Micro 6.2, Debian, and Oracle), install them and reboot. Until then, apply the temporary mitigations and restrict network exposure.
Stay patched, stay safe.
