Loading vulnerability…
Linux Kernel IPv4 TCP Options Use-After-Free
CVE-2026-98432 is a race-induced use-after-free in Linux kernel IPv4 TCP option handling during connection establishment and request-socket migration. tcp_v4_syn_recv_sock() transfers request-socket options to a child socket without copying them. Concurrent retransmitted-SYN processing can continue reading those options under RCU protection while inet_sock_destruct() frees them immediately with kfree(), causing stale accesses in ip_options_build(). A second path occurs when request-socket migration creates a clone sharing the options: tcp_v4_reqsk_destructor() can free them while another CPU still uses the original request socket. Both paths fail to defer reclamation until existing RCU readers have completed. IPv6 is unaffected by the first ownership-transfer issue because its options are duplicated; an analogous IPv6 migration issue involving CALIPSO requires a separate fix.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The vulnerability permits access to freed kernel memory during TCP processing, potentially causing memory corruption, kernel crashes, denial of service, or information disclosure. Anthropic reported a laboratory exploit associated with this CVE that leaked a kernel pointer to bypass KASLR and subsequently overwrote a callback pointer to execute an attacker-selected command as root, without authentication or user interaction, against a multipath TCP listener. The association between that multipath TCP exploit and this specific IPv4 TCP flaw is not independently established by the supplied technical advisories; remote root execution should therefore be treated as a reported, rather than independently corroborated, impact.
If you can’t patch tonight, do this now.
No complete workaround is documented. Disabling request-socket migration by setting net.ipv4.tcp_migrate_req=0 and avoiding BPF_SK_REUSEPORT_SELECT_OR_MIGRATE programs removes the described migration condition, but does not prevent the independent IPv4 child-socket lifetime race. These measures do not replace installing a fixed kernel.
Patch, then assume compromise.
Install a vendor-supported kernel update containing the fix that replaces kfree() with kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor(), ensuring shared options remain valid through an RCU grace period. For Debian 13 (trixie), update the linux packages to 6.12.113-1 or later. For Amazon Linux 2023, apply ALAS2023-2026-3251 using 'dnf update --advisory ALAS2023-2026-3251 --releasever 2023.12.20261026'. For affected Oracle Linux 7 and 8 UEK installations, apply ELSA-2026-500397. Boot into the updated kernel. The analogous IPv6 CALIPSO migration issue requires a separate patch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.