SUMMARY

CVE-2026-98432 is a high-severity vulnerability in the Linux kernel affecting the handling of TCP/IPv4 connections. The issue is a use-after-free (UAF) caused by a race condition during TCP connection establishment.

Under specific concurrent conditions, kernel code may access IP option data after the associated memory has already been freed. This can lead to kernel crashes and denial of service, and may potentially allow kernel memory disclosure or further exploitation depending on the system configuration.

The vulnerability is particularly relevant to Internet-facing Linux systems that accept TCP/IPv4 connections.

The upstream fix replaces ordinary memory deallocation with RCU-aware kfree_rcu(), preventing memory from being released while concurrent readers may still access it.

AFFECTED SYSTEMS AND/OR APPLICATIONS

The vulnerability affects Linux systems using an affected kernel implementation of the TCP/IPv4 networking stack. The exact affected versions depend on the Linux distribution, kernel branch, and vendor backports.

Ubuntu

According to the supplied Ubuntu status information, affected or potentially affected packages include multiple standard, cloud, specialized, and real-time kernel variants.

Notable affected Ubuntu releases/packages include:

• Ubuntu 26.10: linux -- vulnerable fix in progress
• Ubuntu 26.04 LTS: linux -- vulnerable fix in progress
• Ubuntu 24.04 LTS: linux -- vulnerable fix in progress
• Ubuntu 22.04 LTS: linux -- vulnerable fix in progress
• Ubuntu 20.04 LTS: linux -- vulnerable
• Ubuntu 18.04 LTS: linux -- vulnerable
• Ubuntu 16.04 LTS: linux -- vulnerable

Multiple specialized kernel packages are also listed as affected, including variants for:

• AWS
• Azure
• Google Cloud
• Oracle Cloud
• IBM
• GCP/GKE
• NVIDIA
• Raspberry Pi
• VMware
• low-latency and real-time workloads
• FIPS-enabled systems
• KVM and other specialized environments

For several currently supported Ubuntu releases, vendor fixes were listed as "Vulnerable work in progress", meaning that the corrected package was not yet available at the time of the supplied status information.

Administrators should therefore verify the current vendor status before determining that a system is remediated.

Red Hat

The supplied Red Hat information identifies the following products as Affected:

• Red Hat Enterprise Linux 10 -- kernel
• Red Hat Enterprise Linux 9 -- kernel
• Red Hat Enterprise Linux 9 -- kernel-rt
• Red Hat Enterprise Linux 8 -- kernel
• Red Hat Enterprise Linux 8 -- kernel-rt
• Red Hat OpenShift Container Platform 5 -- openshift/ose-rhel-coreos-9
• Red Hat OpenShift Container Platform 4 -- openshift/ose-rhel-coreos-8
• Red Hat OpenShift Container Platform 4 -- openshift/ose-rhel-coreos-9

The supplied Red Hat status identifies RHEL 7 kernel and kernel-rt as Not affected, with the justification that the vulnerable code is not present.

TECHNICAL DETAILS

The vulnerability is caused by unsafe lifetime management of IP option structures used during TCP connection establishment.

During the IPv4 TCP handshake, tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the newly created child socket (newinet->inet_opt) without copying the underlying data.

At the same time, another CPU may process a retransmitted SYN associated with the same request socket. Functions including:

• tcp_check_req()
• tcp_v4_send_synack()
• inet_csk_route_req()
• ip_build_and_send_pkt()
• ip_options_build()

may access the same IP option data while the child socket or associated structures are being released.

These accesses are performed under RCU read-side protection in relevant paths, but the vulnerable destruction paths used ordinary kfree() rather than an RCU-aware free.

The problem became particularly relevant after the introduction of request-socket processing without the listener lock. As a result, concurrent processing on different CPUs can allow the child socket to be freed while the SYN-ACK is still being constructed.

The vulnerable sequence can therefore be summarized as:

1. A TCP/IPv4 connection request is received.
2. IP option data associated with the request socket is transferred to the child socket.
3. Another CPU concurrently processes the request or retransmitted SYN.
4. A socket destruction path releases the shared option structure.
5. A concurrent reader continues accessing the released memory.
6. The kernel performs a use-after-free.

A similar lifetime-management problem can occur during request socket migration, for example when net.ipv4.tcp_migrate_req=1 is enabled or when a BPF SK_REUSEPORT_SELECT_OR_MIGRATE program is used.

During migration, inet_reqsk_clone() may cause the original request socket and its clone to share the same ireq_opt. The original pointer can subsequently be cleared while another CPU still holds a reference to the old request socket and is using the options. If the clone is freed using ordinary kfree(), the shared memory can again be accessed after it has been released.

The upstream remediation changes the relevant deallocation mechanisms to kfree_rcu() in:

• inet_sock_destruct()
• tcp_v4_reqsk_destructor()

This ensures that the memory remains available until all relevant RCU readers have completed.

Security impact

The most immediate impact is potential kernel instability or denial of service, including a kernel panic or system crash.

Depending on the precise kernel configuration, memory layout, and an attacker's ability to reliably control the race condition, a use-after-free may also provide opportunities for:

• disclosure of kernel memory,
• weakening of kernel address-space randomization,
• corruption of kernel data,
• privilege escalation, or
• execution of attacker-controlled code in kernel context.

The supplied information does not establish that reliable remote code execution is universally achievable on affected systems. Exploitability is expected to depend on the particular kernel version, configuration, enabled networking features, and other environmental factors.

IPv6 is not affected by the primary issue described above because tcp_v6_syn_recv_sock() duplicates the relevant options instead of transferring the same structure in the vulnerable manner. A separate IPv6 request-socket migration issue has been identified and is being addressed independently.

MITIGATION

1. Update the Linux kernel to a vendor-provided version containing the CVE-2026-98432 fix.
2. Reboot affected systems after the kernel update to ensure the patched kernel is running.
3. Prioritize Internet-facing and business-critical systems accepting TCP/IPv4 connections.
4. Verify all specialized kernels, including cloud, FIPS, real-time, low-latency and hardware-specific variants.
5. Until patches are available, reduce exposure using firewalls, security groups, network segmentation and removal of unnecessary public TCP services.
6. Review systems using net.ipv4.tcp_migrate_req=1 or BPF-based TCP request migration.
7. Monitor affected hosts for kernel panics, unexpected reboots, service crashes and unusual networking-related kernel errors.

Mitigations should be considered temporary; applying the vendor kernel update remains the recommended remediation.

What the Cyber Fusion Center Is Doing

The CFC is monitoring the situation and analyzing the case to identify potential threat-hunting campaigns. This advisory will be updated if required.

REFERENCES

1. Ubuntu Security - CVE-2026-98432: https://ubuntu.com/security/CVE-2026-98432
2. NVD - CVE-2026-98432: https://nvd.nist.gov/vuln/detail/CVE-2026-98432
3. CVE Record - CVE-2026-98432: https://www.cve.org/CVERecord?id=CVE-2026-98432
4. Red Hat Security - CVE-2026-98432: https://access.redhat.com/security/cve/CVE-2026-98432

‍