Linux CVE-2026-98432: remote use-after-free in kernel TCP handling of IPv4 options

Summary

• The Linux kernel can read freed memory while replying to a TCP connection request that carries IPv4 options. The race involves a retransmitted SYN. The CVE record was published on 15 October 2026 and scores it 9.8 on CVSS 3.1.
• On 27 October, Anthropic reported a working attack. Its proof of concept got root commands on a Linux server with an MPTCP listener, with no credentials. It took about 48 minutes to leak a kernel pointer and about 5 more to finish.
• The bug is not limited to MPTCP. Red Hat and the Go team both say so.

Exposure

• Affected: kernels from 4.4 onward, until these fixed stable versions: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3.
• The CVE record lists no fix for 7.0, 7.1 or 5.4, and kernel.org no longer lists those branches. Ask your vendor.
• The record describes a second route when net.ipv4.tcp_migrate_req=1 is set or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is used. IPv6 is not affected by the first issue. The record says a related IPv6 migration issue will be patched separately.
• Go 1.24 and later turn on MPTCP by default for Linux listening sockets, so Go servers can present an MPTCP listener without anyone choosing it.
• Red Hat rates this Critical for RHEL 8, 9 and 10, OpenShift 4 and products on the RHEL kernel. MPTCP is off by default on RHEL, and Red Hat says default systems remain vulnerable.

Vendor status when we checked:

• Debian: fixed in bookworm 6.1.190-1, trixie 6.12.113-1, bookworm's linux-6.12 6.12.113-1~deb12u1, and unstable 7.2.10-1.
• AlmaLinux: fixed in kernel-4.18.0-553.182.1.el8_10, kernel-5.14.0-687.64.1.el9_8, and kernel-6.12.0-211.72.1.el10_2.
• Ubuntu: 26.10, 26.04, 24.04 and 22.04 marked vulnerable with fixes in progress (7.3.0-10.10, 7.0.0-43.43, 6.8.0-149.149, 5.15.0-203.213). 20.04, 18.04 and 16.04 marked vulnerable. 14.04 not affected.
• Red Hat: no fixed errata listed on its bulletin, last updated 4 November. Check the bulletin for changes.

Exploitation: not established. As of 5 November 2026, the CISA KEV catalog does not list this CVE, and CISA has no exploitation rating on the record. Anthropic, Red Hat, Ubuntu, AlmaLinux and the Go team do not report attacks. Akamai said on 2 November it knew of no public working exploit, and that Anthropic had not released its own. This can change quickly, because a working attack has been shown.

Actions

1. Run uname -r on each host and compare it with your vendor's fixed kernel above.
2. Install the fixed kernel and reboot. The fix does not apply until you reboot. Run uname -r again afterwards.
3. If no fixed kernel exists yet, consider Red Hat's stopgap, which drops IPv4 TCP packets carrying options. Test it first: it breaks IPv4-options TCP, including CIPSO and NetLabel. Ubuntu says this kind of rule reduces risk without fully preventing attack. Save this as cve-2026-98432.nft:

   table inet cve_2026_98432 {
       chain input {
           type filter hook input priority -310; policy accept;
           ip protocol tcp ip hdrlength > 5 counter drop
       }
   }
   

4. Load and confirm the rule:

   sudo nft --check --file cve-2026-98432.nft
   sudo nft --file cve-2026-98432.nft
   sudo nft list table inet cve_2026_98432
   

   The rule does not survive a reboot. It does not filter pod-to-pod traffic, and containers need their own rule.
5. Reduce MPTCP exposure if you do not need it. For Go programs, set GODEBUG=multipathtcp=0 or add godebug multipathtcp=0 to go.mod. To turn MPTCP off system-wide, run sysctl -w net.mptcp.enabled=0, which can break programs that use it. This does not fix the bug.
6. Do not rely on ss -Mlnp to clear a host. Red Hat says it checks only one known setup. Reports on oss-security also say init_on_free=1 is not a mitigation.
7. After the fixed kernel is running, remove the stopgap with sudo nft delete table inet cve_2026_98432.

Sources

• CVE-2026-98432: CVE record from the Linux kernel team. Cause, routes, affected and fixed versions, IPv6 note, score.
• kernel.org: project page. Current maintained branches.
• Anthropic research post, 27 October 2026: research. Remote root demonstration on an MPTCP listener, timings.
• Red Hat RHSB-2026-016: vendor advisory. Products, default exposure, nft rule, limits of ss -Mlnp.
• Ubuntu CVE-2026-98432: vendor status. Package state, limits of the rule.
• Debian tracker: vendor status. Fixed Debian packages.
• AlmaLinux, 30 October 2026: vendor advisory. Fixed kernels, reboot check, CIPSO and NetLabel breakage.
• Go team on oss-security, 30 October 2026: vendor notice. Go default, GODEBUG and go.mod settings, bug not specific to MPTCP.
• oss-security, 30 October 2026: mailing list. The sysctl command and its side effect.
• oss-security, 31 October 2026 and 3 November 2026: mailing list. init_on_free is not a mitigation, and disabling MPTCP alone is not enough.
• Akamai research, 2 November 2026: research. No public working exploit known at that date.
• CISA KEV feed, version 2026.11.04: CISA KEV. This CVE is not listed.