Skip to content
Centoculus

Security alert · Critical

Critical Linux kernel TCP flaw CVE-2026-98432: use-after-free in IPv4 handshake

· 3 minutes read · Centoculus Security Team

Known since

Affected: Linux kernel, IPv4 TCP stack (fixed versions: see your distribution's advisory)

What happened

On 15 October 2026 a vulnerability in the TCP/IPv4 code of the Linux kernel was made public as CVE-2026-98432. It has a CVSS base score of 9.8 (critical). There is no confirmed active exploitation so far.

The flaw is a use-after-free during the TCP handshake. When a server accepts a connection, the kernel hands the IP options of the pending connection over to the new child socket without copying them. If a retransmitted SYN for the same connection is processed on another CPU at the same time, the kernel can still be building a SYN-ACK with those options while the child socket, and with it the options, has already been freed. The memory is then read after it was released in ip_options_build().

A similar problem exists with request socket migration, which is used when net.ipv4.tcp_migrate_req=1 is set or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is loaded.

The fix changes the kernel to free these option structures only after an RCU grace period (kfree_rcu()), as other code paths already do. The patches have been merged into the stable kernel branches; distributions are preparing and shipping updated kernel packages.

Who is affected

  • Linux servers that accept TCP connections over IPv4, which covers practically every web, mail, database and application server.
  • Systems with net.ipv4.tcp_migrate_req=1 or a reuseport migration BPF program are additionally exposed to the second issue.
  • IPv6 is not affected by the main issue. A related migration issue in IPv6 (only relevant with CALIPSO) will be fixed in a separate patch.

The exact affected and fixed kernel versions are not listed in the source data. Check the security advisory of your distribution and the kernel commits linked below.

What to do now

  1. Check your distribution's security tracker (Debian, Ubuntu, RHEL/AlmaLinux/Rocky, SUSE and others) for CVE-2026-98432 and note the fixed kernel package version.
  2. Install the updated kernel package, for example apt update && apt full-upgrade on Debian/Ubuntu or dnf update kernel on RHEL-based systems.
  3. Reboot the server so the new kernel is actually running. If you use a live patching service, confirm that a live patch for this CVE has been applied.
  4. After the reboot, check that all services are running again (web server, database, mail, containers).
  5. Until the update is in place, consider leaving net.ipv4.tcp_migrate_req at its default of 0 unless you need it.
  6. For hosted servers and VPS where the provider manages the kernel, ask the provider whether the fix is installed.

How to check whether you are affected

  • Show the running kernel with uname -r and compare it with the fixed version in your distribution's advisory. An installed but not yet booted kernel does not protect you.
  • Check the migration setting with sysctl net.ipv4.tcp_migrate_req. A value of 1 means the second issue also applies.
  • Look through the kernel log for crashes in the network stack, for example with journalctl -k | grep -iE 'oops|general protection|ip_options_build'. Unexplained kernel crashes or reboots on internet-facing servers are worth investigating.

Sources

More sources (7)

More on Linux kernel

If you run Linux servers, also check

Related posts