CVE-2026-98432: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98432 Overview

CVE-2026-98432 is a use-after-free vulnerability in the Linux kernel IPv4 TCP stack. The flaw resides in how tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to a child socket without copying it. A concurrent CPU processing a retransmitted SYN for the same request socket can access the freed IP options while building a SYNACK, triggering a use-after-free in ip_options_build(). The issue stems from commit 079096f103fa, which installed syn_recv requests into the ehash table and allowed request-socket processing without the listener lock. A related variant affects request socket migration when net.ipv4.tcp_migrate_req=1 is set or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is attached.

Critical Impact
Remote attackers can trigger a kernel use-after-free by sending retransmitted SYN packets against listening TCP sockets, potentially leading to memory corruption or denial of service.

Affected Products

Linux kernel IPv4 TCP stack (networking subsystem)
Kernel builds including commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table")
Deployments using net.ipv4.tcp_migrate_req=1 or BPF_SK_REUSEPORT_SELECT_OR_MIGRATE programs

Discovery Timeline

2026-10-15 - CVE-2026-98432 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98432

Vulnerability Analysis

The vulnerability occurs during TCP three-way handshake processing in the IPv4 stack. When tcp_v4_syn_recv_sock() creates a child socket, it transfers ownership of ireq->ireq_opt to newinet->inet_opt by pointer assignment, not by copying. Readers such as tcp_v4_send_synack(), inet_csk_route_req(), ip_build_and_send_pkt(), and ip_options_build() access these options under rcu_read_lock() only, and ip_options_build() dereferences opt->optlen twice.

Because request sockets no longer hold the listener lock during processing, a second CPU handling a retransmitted SYN can race with the child socket creation. TCP child sockets do not use SOCK_RCU_FREE, so inet_sock_destruct() releases inet_opt with a plain kfree(). The reader on the second CPU then dereferences freed memory inside ip_options_build().

A parallel defect exists in request socket migration. reqsk_timer_handler() clones the request socket via inet_reqsk_clone(), so the original and clone share ireq_opt. reqsk_migrate_reset() nulls the pointer in the original, but another CPU holding a reference can still read it while tcp_v4_reqsk_destructor() frees the memory with kfree().

Root Cause

The root cause is a mismatch between reader and writer memory reclamation semantics. Readers traverse inet_opt and ireq_opt under RCU protection, while writers free these structures with plain kfree() instead of kfree_rcu(). Other code paths that replace inet_opt, including do_ip_setsockopt() and cipso_v4_sock_setattr(), already use kfree_rcu(), but inet_sock_destruct() and tcp_v4_reqsk_destructor() did not.

Attack Vector

An attacker sends an initial SYN followed by one or more retransmitted SYNs targeting a listening TCP socket. Concurrent processing on different CPUs creates a window where one path frees the IP options while another path is still reading them to build a SYNACK. Successful exploitation requires precise timing, SMP execution, and attacker control over TCP IP options or kernel heap layout to escalate the memory corruption beyond a crash.

The vulnerability is described in prose rather than code because no verified proof-of-concept has been published. See the Kernel Commit a47406c7 for the authoritative patch and additional technical context.

Detection Methods for CVE-2026-98432

Indicators of Compromise

Kernel oops or KASAN use-after-free reports referencing ip_options_build, inet_sock_destruct, or tcp_v4_reqsk_destructor.
Unexpected TCP SYNACK anomalies or kernel panics on hosts exposing listening TCP services to untrusted networks.
Repeated identical SYN retransmissions from the same source targeting a single listener socket in short time windows.

Detection Strategies

Enable KASAN on test and staging kernels to surface the use-after-free during fuzzing or load testing.
Correlate kernel ring-buffer messages with network telemetry to spot SYN-flood-like patterns coinciding with crashes.
Monitor for unexpected process restarts or watchdog-triggered reboots on edge nodes terminating external TCP connections.

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized logging platform and alert on BUG:, KASAN:, or use-after-free strings.
Track TCP SYN retransmission rates per source with ss, nstat, or eBPF-based network observability tools.
Audit kernel versions across the fleet to confirm whether the stable patches listed in the kernel.org references are applied.

How to Mitigate CVE-2026-98432

Immediate Actions Required

Apply the stable kernel updates containing the fix that replaces kfree() with kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor().
Prioritize patching on internet-facing hosts and load balancers that terminate TCP connections from untrusted networks.
Reboot affected systems after installing updated kernel packages to ensure the new networking code is active.

Patch Information

The fix uses kfree_rcu() so that inet_opt and ireq_opt are released only after an RCU grace period, allowing concurrent readers to complete safely. Patches are available in the mainline and stable trees: Kernel Commit 11a03ce3, Kernel Commit 26d4c36d, Kernel Commit 742f73df, Kernel Commit 89b5b1eb, Kernel Commit 95a8c8fa, Kernel Commit a47406c7, Kernel Commit b3b027ef, and Kernel Commit e3f33b0a. IPv6 is not affected by the first issue because tcp_v6_syn_recv_sock() duplicates the options; the related tcp_v6_reqsk_destructor() migration issue is handled in a separate patch.

Workarounds

Disable request socket migration by setting net.ipv4.tcp_migrate_req=0 to eliminate the migration-based race path.
Remove BPF_SK_REUSEPORT_SELECT_OR_MIGRATE programs from reuseport groups until the kernel can be patched.
Restrict exposure of listening TCP services to trusted networks using firewall rules or network segmentation.

bash

# Verify and disable TCP request socket migration
sysctl net.ipv4.tcp_migrate_req
sysctl -w net.ipv4.tcp_migrate_req=0

# Persist the setting across reboots
echo 'net.ipv4.tcp_migrate_req = 0' >> /etc/sysctl.d/99-cve-2026-98432.conf
sysctl --system