A critical use-after-free in the Linux kernel’s IPv4 TCP implementation, CVE-2026-98432, was disclosed this week with a CVSS 3.1 score of 9.8 assigned by the kernel CNA. The bug is reachable by a remote, unauthenticated peer against any host with a listening TCP service, before any application-layer authentication takes place. Ubuntu has said a separate patch will address a related IPv6 issue.

What happened

The flaw is a race condition in the passive-open path, associated with tcp_v4_syn_recv_sock(). When retransmitted connection requests are processed concurrently, or when sockets migrate between listeners, IP socket options can be freed while another CPU still holds a reference to them. The result is a use-after-free of kernel heap memory.

According to Red Hat’s CVE entry, the primary confirmed outcome is a kernel crash (denial of service), with potential memory corruption. Secondary reporting also describes a possible leak of freed kernel heap contents back to the peer. The upstream fix replaces plain frees of the affected options with RCU-deferred frees, so memory is not reclaimed until all readers are done.

Exploitability: what is and isn’t confirmed

Several secondary sources and social media posts claim a working remote-to-root exploit exists, that it targets servers with a Multipath TCP listener, and that it was developed with AI assistance in under an hour. We could not verify these claims against a primary source, and no public exploit has been released. Treat remote code execution as plausible given the bug class and the trigger location, not as demonstrated. Remote denial of service should be treated as reachable today.

At the time of writing we found no confirmation of in-the-wild exploitation and the CVE is not in CISA’s KEV catalog.

Affected versions

The vulnerable code reportedly dates back to Linux 4.4. Fixed stable releases reported by secondary sources:

  • 5.10.272
  • 5.15.223
  • 6.1.190
  • 6.6.159
  • 6.12.113
  • 6.18.56
  • 7.2.10
  • 7.3

Distribution status conflicts between sources. Red Hat states it is still working on a fix; some reports list Ubuntu and RHEL as unpatched. Verify against your vendor’s tracker rather than relying on version numbers alone, because enterprise kernels backport fixes without bumping the upstream version.

Who is exposed

Anything running a Linux kernel in the affected range with an IPv4 TCP listener: public web and API servers, bastions, VPN and proxy endpoints, Kubernetes nodes exposing NodePorts, and cloud VMs with open security groups. Containers share the host kernel, so a container with a reachable listening port is as exposed as the host. Hosts that only accept TCP from trusted networks have a much smaller attack surface, which makes internet-facing systems the first priority.

Mitigation

  1. Patch and reboot. Apply your distribution’s kernel update as soon as it ships and reboot (or use live patching if your vendor provides it for this CVE). Confirm with your distro’s CVE tracker, not just uname -r.
  2. Reduce exposure until patched. Restrict inbound TCP to known source ranges with security groups, firewalls, or nftables. Close unneeded listeners.
  3. Check Multipath TCP. If reports about MPTCP listeners hold, disabling it where unused (sysctl net.mptcp.enabled=0) is a low-cost hardening step, though it is not a verified fix for this CVE.
  4. Watch for crashes. Unexplained kernel panics, oops messages referencing TCP socket-option handling, or repeated reboots on edge hosts may indicate probing. Ship kdump and dmesg output to central logging.
  5. Track the IPv6 follow-up. Ubuntu has flagged a related IPv6 patch; plan for a second kernel update.

References