{"id":5284,"date":"2026-10-29T15:55:03","date_gmt":"2026-10-29T20:55:03","guid":{"rendered":"https:\/\/dialer.one\/?p=5284"},"modified":"2026-10-29T15:55:25","modified_gmt":"2026-10-29T20:55:25","slug":"cve-2026-98432-critical-linux-kernel-use-after-free-in-ipv4-tcp-what-it-is-and-how-to-fix-it","status":"publish","type":"post","link":"https:\/\/dialer.one\/index.php\/cve-2026-98432-critical-linux-kernel-use-after-free-in-ipv4-tcp-what-it-is-and-how-to-fix-it\/","title":{"rendered":"CVE-2026-98432: Critical Linux Kernel Use-After-Free in IPv4 TCP \u2014 What It Is and How to Fix It"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>CVE-2026-98432: Critical Linux Kernel Use-After-Free in IPv4 TCP \u2014 What It Is and How to Fix It<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A critical vulnerability in the Linux kernel (CVE-2026-98432) has drawn significant attention. Rated <strong>9.8 (Critical)<\/strong> by the Linux kernel CVE team and marked <strong>High<\/strong> priority by Ubuntu, it involves a use-after-free race condition in IPv4 TCP option handling.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As of late October 2026, fixed packages are available on several distributions including Debian, Oracle Linux, parts of Amazon Linux, openSUSE Leap 16.0, and SUSE Linux Micro 6.2. Ubuntu still lists supported releases as vulnerable with fixes in progress, while Red Hat has deferred its fix. A research demonstration (involving Anthropic\u2019s Claude) reportedly produced a laboratory remote-root exploit under specific conditions, underscoring the need for prompt action once patches arrive.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What Is CVE-2026-98432?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The bug lives in the IPv4 TCP handshake code. When the kernel creates a new child socket from a request socket (<code>tcp_v4_syn_recv_sock()<\/code>), it transfers ownership of the IP options (<code>ireq-&gt;ireq_opt<\/code> \u2192 <code>newinet-&gt;inet_opt<\/code>) <strong>without copying them<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A concurrent CPU can process a retransmitted SYN for the same request socket and build a SYNACK (<code>tcp_v4_send_synack()<\/code> \u2192 <code>ip_options_build()<\/code>). Because the options are freed with a plain <code>kfree()<\/code> (no RCU grace period) when the child socket is destroyed, this creates a classic use-after-free. A related path exists with TCP request-socket migration (<code>net.ipv4.tcp_migrate_req=1<\/code> or certain BPF programs).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">IPv6 is largely unaffected by the primary issue (options are duplicated), though a similar migration problem exists for CALIPSO and is addressed separately.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The flaw has been present since roughly Linux 4.4. Upstream fixed it by switching to <code>kfree_rcu()<\/code> in the relevant destructors (commit <code>e3f33b0a1d89...<\/code>). Stable kernels that include the fix include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and mainline 7.3+.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Impact and Exploitability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Remote, unauthenticated<\/strong> network attack surface (TCP connections).<\/li>\n\n\n\n<li>Potential outcomes: kernel crash \/ denial of service, memory corruption, or (in advanced cases) privilege escalation to root.<\/li>\n\n\n\n<li>Winning the race is non-trivial, which is why some vendors score it lower (e.g., SUSE and Oracle 8.1, Red Hat ~5.9\u20138.1, Amazon 7.0). Ubuntu and the kernel CNA use the 9.8 score.<\/li>\n\n\n\n<li>No confirmed widespread in-the-wild exploitation has been reported as of this writing, and it is not listed in CISA\u2019s KEV catalog. However, a public research demonstration of a zero-click remote-root chain (particularly effective against multipath TCP listeners) raises the urgency.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Any system accepting TCP connections on a vulnerable kernel is potentially exposed\u2014servers, cloud instances, containers sharing the host kernel, etc.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Current Status (as of 29 October 2026)<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Distribution<\/th><th>Status<\/th><th>Notes \/ Fixed Version<\/th><\/tr><\/thead><tbody><tr><td>Ubuntu 22.04 \/ 24.04 \/ 26.04 \/ 26.10<\/td><td>Vulnerable \u2013 fix in progress<\/td><td>Target versions exist but not yet released<\/td><\/tr><tr><td>Ubuntu 16.04 \/ 18.04 \/ 20.04<\/td><td>Vulnerable<\/td><td>No fix date announced<\/td><\/tr><tr><td>Debian 12 (bookworm) \/ 13 (trixie)<\/td><td>Fixed<\/td><td>6.1.190-1 \/ 6.12.113-1<\/td><\/tr><tr><td>Oracle Linux (UEK)<\/td><td>Fixed<\/td><td>Multiple ELSA advisories<\/td><\/tr><tr><td>Amazon Linux 2023 (some kernels)<\/td><td>Partially fixed<\/td><td>kernel 6.18 and 6.12 fixed; others pending<\/td><\/tr><tr><td><strong>openSUSE Leap 16.0<\/strong><\/td><td><strong>Fixed<\/strong><\/td><td>kernel 6.12.0-160000.40.1 or later<\/td><\/tr><tr><td><strong>SUSE Linux Micro 6.2<\/strong><\/td><td><strong>Fixed<\/strong><\/td><td>kernel 6.12.0-160000.40.1 or later<\/td><\/tr><tr><td>SLES 15 SP4\u2013SP6 LTSS \/ SLES 16.0<\/td><td>Fixed or in progress<\/td><td>See SUSE advisories (e.g. SUSE-SU-2026:24386-1)<\/td><\/tr><tr><td>RHEL 8\/9\/10 + OpenShift<\/td><td>Fix deferred<\/td><td>No released packages yet<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Always check the official trackers (Ubuntu CVE page, SUSE CVE page, etc.) for the latest package status, as this changes quickly.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How to Check If You Are Affected<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Identify your running kernel: <code>uname -r<\/code><\/li>\n\n\n\n<li>On Ubuntu: <code>dpkg -l | grep linux-image<\/code>Then match against <a href=\"https:\/\/ubuntu.com\/security\/CVE-2026-98432\" target=\"_blank\" rel=\"noopener\">https:\/\/ubuntu.com\/security\/CVE-2026-98432<\/a>.<\/li>\n\n\n\n<li>On openSUSE \/ SUSE: <code>rpm -q kernel-default # or zypper se -s kernel-default<\/code>Compare against the fixed version (e.g. 6.12.0-160000.40.1+).<\/li>\n\n\n\n<li>Monitor for available updates on your distribution.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Steps to Fix the Vulnerability<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Primary fix: Install the patched kernel and reboot.<\/strong><\/p>\n\n\n\n<h4 class=\"wp-block-heading\">On Ubuntu (once packages are published)<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update\nsudo apt full-upgrade\nsudo reboot<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">On Debian<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update\nsudo apt full-upgrade\nsudo reboot<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">On openSUSE Leap \/ SUSE Linux Enterprise \/ SUSE Linux Micro<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo zypper refresh\nsudo zypper update\n# or more specifically:\nsudo zypper in -t patch openSUSE-...   # follow the exact patch name from the advisory\n# or\nsudo zypper up kernel-default\nsudo reboot<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For openSUSE Leap 16.0 and SUSE Linux Micro 6.2 the fixed kernel is <strong>6.12.0-160000.40.1<\/strong> (or later). After updating, confirm with <code>uname -r<\/code>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">On RHEL \/ AlmaLinux \/ Rocky \/ Oracle (when available)<\/h4>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf update kernel\nsudo reboot<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Important:<\/strong> The vulnerability is fixed only after the system is running the patched kernel. Simply installing the package is not enough\u2014reboot is mandatory.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Temporary Mitigations (While Waiting for Patches)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">These reduce attack surface but do <strong>not<\/strong> fully eliminate the primary race:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Disable TCP request-socket migration: <code>sudo sysctl -w net.ipv4.tcp_migrate_req=0<\/code>Make it persistent by adding the line to <code>\/etc\/sysctl.d\/99-tcp-migrate.conf<\/code> (or similar) and running <code>sysctl --system<\/code>.<\/li>\n\n\n\n<li>Limit exposure of TCP services to untrusted networks (firewall rules, security groups, reverse proxies).<\/li>\n\n\n\n<li>Prefer IPv6-only listeners where feasible (the primary path is IPv4-specific).<\/li>\n\n\n\n<li>Avoid enabling multipath TCP (MPTCP) on publicly reachable services if not required.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">These are stop-gaps only. The real solution is the kernel update.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Best Practices Going Forward<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Subscribe to your distribution\u2019s security notices (Ubuntu USN, SUSE Security Advisories, etc.).<\/li>\n\n\n\n<li>Enable automatic security updates where appropriate, but treat kernel updates carefully (test first in non-production).<\/li>\n\n\n\n<li>Maintain an inventory of kernel versions across your fleet (especially cloud instances and containers).<\/li>\n\n\n\n<li>For high-security environments, consider live-patching solutions once they support this CVE, though a full reboot remains the cleanest approach for kernel fixes of this type.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Conclusion<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">CVE-2026-98432 is a serious race-condition use-after-free in a core networking path. While reliable remote exploitation is non-trivial, the combination of a 9.8 CVSS score, network reachability without authentication, and demonstrated research exploits makes it high priority.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Monitor the official trackers closely. As soon as fixed kernel packages appear for your release (already available for openSUSE Leap 16.0, SUSE Linux Micro 6.2, Debian, and Oracle), install them and reboot. Until then, apply the temporary mitigations and restrict network exposure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Stay patched, stay safe.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE-2026-98432: Critical Linux Kernel Use-After-Free in IPv4 TCP \u2014 What It Is and How to Fix It A critical vulnerability in the Linux kernel (CVE-2026-98432) has drawn significant attention. Rated 9.8 (Critical) by the Linux kernel CVE team and marked High priority by Ubuntu, it involves a use-after-free race condition in IPv4 TCP option handling. [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":5285,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[96],"tags":[533,531,536],"class_list":["post-5284","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-vicidial","tag-howto","tag-security","tag-vicidial"],"jetpack_publicize_connections":[],"jetpack-related-posts":[{"id":3689,"url":"https:\/\/dialer.one\/index.php\/how-to-fix-vicibox-11-after-kernel-update\/","url_meta":{"origin":5284,"position":0},"title":"How to &#8211; Fix ViciBox 11 after kernel update","author":"carpenox","date":"October 5, 2023","format":false,"excerpt":"How to - Fix ViciBox 11 after kernel update Ok, so it seems that if you run a \"zypper up\" on ViciBox 11, it will update the kernel which then leaves dahdi with errors that won't allow it to start up and calls will have no audio and you will\u2026","rel":"","context":"In &quot;Vicidial&quot;","block_context":{"text":"Vicidial","link":"https:\/\/dialer.one\/index.php\/category\/vicidial\/"},"img":{"alt_text":"ViciBox 11","src":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2023\/10\/image-1.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2023\/10\/image-1.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2023\/10\/image-1.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2023\/10\/image-1.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":3455,"url":"https:\/\/dialer.one\/index.php\/how-to-install-vicidial-on-alma-linux-9-with-my-new-auto-installer\/","url_meta":{"origin":5284,"position":1},"title":"How to &#8211; Install Vicidial on Alma Linux 9 with my new auto installer","author":"carpenox","date":"September 15, 2023","format":false,"excerpt":"How to - Install Vicidial on Alma Linux 9 with my new auto installer That's right, I have fixed the issues with dahdi and php7 installations on Alma Linux 9 and created the auto installer for it, complete with the dynamic portal and the CyburPhone. Its been tested and is\u2026","rel":"","context":"In &quot;Vicidial&quot;","block_context":{"text":"Vicidial","link":"https:\/\/dialer.one\/index.php\/category\/vicidial\/"},"img":{"alt_text":"Alma Linux 9 Vicidial","src":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2023\/09\/OIG-25-12.jpeg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2023\/09\/OIG-25-12.jpeg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2023\/09\/OIG-25-12.jpeg?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2023\/09\/OIG-25-12.jpeg?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":2673,"url":"https:\/\/dialer.one\/index.php\/how-to-use-firewalld-via-command-line\/","url_meta":{"origin":5284,"position":2},"title":"How to &#8211; Use Firewalld via command line","author":"carpenox","date":"August 31, 2022","format":false,"excerpt":"Hopefully this will help a lot of you that end up just not using a firewall at all because it intimidates you not knowing how to use it correctly. Well, I've just eliminated that excuse, so now I want to see more of you securing your servers and dialer systems.\u2026","rel":"","context":"In &quot;CyburDial&quot;","block_context":{"text":"CyburDial","link":"https:\/\/dialer.one\/index.php\/category\/cyburdial\/"},"img":{"alt_text":"Robots trying to hack in","src":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/08\/robot-hackers-tryin-to-break-into-servers-2.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/08\/robot-hackers-tryin-to-break-into-servers-2.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/08\/robot-hackers-tryin-to-break-into-servers-2.jpg?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2022\/08\/robot-hackers-tryin-to-break-into-servers-2.jpg?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":5281,"url":"https:\/\/dialer.one\/index.php\/php2shell-critical-php-remote-code-execution-vulnerabilities-require-immediate-action\/","url_meta":{"origin":5284,"position":3},"title":"PHP2Shell: Critical PHP Remote Code Execution Vulnerabilities Require Immediate Action","author":"carpenox","date":"October 23, 2026","format":false,"excerpt":"PHP2Shell: Critical PHP Remote Code Execution Vulnerabilities Require Immediate Action The PHP community has released emergency security updates to address two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively being referred to as PHP2Shell. Both vulnerabilities can allow an unauthenticated attacker to execute code on affected web servers through\u2026","rel":"","context":"In &quot;CyburDial&quot;","block_context":{"text":"CyburDial","link":"https:\/\/dialer.one\/index.php\/category\/cyburdial\/"},"img":{"alt_text":"phpshell","src":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2026\/10\/phpshell.webp?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2026\/10\/phpshell.webp?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2026\/10\/phpshell.webp?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2026\/10\/phpshell.webp?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2026\/10\/phpshell.webp?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2026\/10\/phpshell.webp?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":5150,"url":"https:\/\/dialer.one\/index.php\/how-to-install-vicidial-on-alma-linux-10\/","url_meta":{"origin":5284,"position":4},"title":"How to &#8211; Install ViciDial on Alma Linux 10","author":"carpenox","date":"January 29, 2026","format":false,"excerpt":"How to - Install ViciDial on Alma Linux 10 How to Install VICIdial on AlmaLinux 10 Using My Updated Auto\u2011Installer VICIdial admins have been waiting for this one. AlmaLinux 10 is here with a modernized kernel, updated libraries, and a cleaner security model \u2014 but it also breaks a lot\u2026","rel":"","context":"Similar post","block_context":{"text":"Similar post","link":""},"img":{"alt_text":"Alma 10","src":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2026\/01\/image.webp?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2026\/01\/image.webp?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/dialer.one\/wp-content\/uploads\/2026\/01\/image.webp?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":2936,"url":"https:\/\/dialer.one\/index.php\/how-to-upgrade-opensuse-leap-15-3-to-15-4\/","url_meta":{"origin":5284,"position":5},"title":"How to &#8211; Upgrade OpenSuSE Leap 15.3 to 15.4","author":"carpenox","date":"May 27, 2023","format":false,"excerpt":"How to - Upgrade OpenSuSE Leap 15.3 to 15.4 This article will go over how to upgrade Leap 15.3 to 15.4 since 15.3 is end of life Step 1. Preparations \u2013 Backup everything Keep verified backups: Do not skip this step. Before typing the following commands, you must back up\u2026","rel":"","context":"In &quot;Vicidial&quot;","block_context":{"text":"Vicidial","link":"https:\/\/dialer.one\/index.php\/category\/vicidial\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/dialer.one\/wp-content\/uploads\/2026\/10\/cyburdial-dialer.one-6ae3b25b35a1c.webp","_links":{"self":[{"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/posts\/5284","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/comments?post=5284"}],"version-history":[{"count":1,"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/posts\/5284\/revisions"}],"predecessor-version":[{"id":5286,"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/posts\/5284\/revisions\/5286"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/media\/5285"}],"wp:attachment":[{"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/media?parent=5284"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/categories?post=5284"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dialer.one\/index.php\/wp-json\/wp\/v2\/tags?post=5284"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}