The CVE-2026-98432 vulnerability in the Linux kernel IPv4 TCP networking stack allows a remote unauthenticated attacker to achieve arbitrary code execution by exploiting a race condition in TCP connection handling. The issue affects all kernel versions starting from 4.4 and impacts any system with an open TCP port that accepts IPv4 connections. Red Hat and Canonical classify the vulnerability as critical, assigning it a CVSS score of 9.8. Patches are already available for RHEL, Amazon Linux, and partially for Ubuntu; administrators need to update the kernel and reboot systems.
Technical details of the vulnerability
The issue is a use-after-free and occurs in the tcp_v4_syn_recv_sock() function. When accepting an incoming IPv4 TCP connection, the kernel passes IP options from the request socket to the child socket without copying them. If the client resends the SYN packet while another CPU is still reading these options, the kernel accesses already freed memory in the ip_options_build() function. Child TCP sockets do not have the SOCK_RCU_FREE flag, and the inet_sock_destruct() destructor frees inet_opt using a regular kfree() instead of kfree_rcu().
An attacker triggers the race by sending TCP connection requests with IPv4 Record Route or Timestamp options to any listening TCP port. No authentication is required. A similar issue exists when migrating request sockets (net.ipv4.tcp_migrate_req=1). According to Canonical, IPv6 is not affected by the core issue because the IPv6 processing path duplicates options.
The fix replaces kfree() with kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor(), ensuring that memory is freed only after the RCU grace period has completed.
Diverging severity ratings
Notably, vendors differ in how they assess the criticality of the issue. Fortinet, Red Hat, and Ubuntu assign CVSSv3 9.8 and mark it as Critical, citing the possibility of remote code execution. Amazon Linux, by contrast, rates the vulnerability at 8.1 (Important), emphasizing denial of service and potential memory corruption as the primary impacts. This discrepancy reflects different views on practical exploitability: the race condition requires precise timing, and not every vendor considers reliable RCE to be guaranteed.
Exploitation status
According to Fortinet, the vulnerability has not been observed in active exploitation. Canonical reports that, apart from internal research by Anthropic, no other exploits are known. Code has been published on GitHub that demonstrates the race condition and detects use-after-free in the SYN-ACK, but without implementing code execution. We have already written that Anthropic’s internal research model created a working exploit for this vulnerability, allowing unauthenticated attackers to gain root access on servers with an MPTCP listener. The exploit code has not been released.
Affected systems and available patches
The vulnerability affects a wide range of Linux distributions:
- Red Hat Enterprise Linux 8, 9, 10 and Red Hat OpenShift Container Platform — patches were released on November 1 (RHSA-2026:93414, RHSA-2026:93412, RHSA-2026:93413). Red Hat also notes that products based on the RHEL kernel, including Red Hat OpenStack Platform and Red Hat Virtualization, may be affected.
- Ubuntu 22.04, 24.04, 26.04 LTS — fixes are available in the -proposed pocket (kernel versions 5.15.0-203.213, 6.8.0-149.149, and 7.0.0-43.43 respectively). Packages from -proposed are not installed automatically. Ubuntu 26.10 is fixed in the main pocket. For Ubuntu 20.04 and earlier, patches are not yet available.
- Amazon Linux 2 and Amazon Linux 2023 — fixes were released between October 24 and 30.
- Fortinet — is assessing impact across more than 50 products, including FortiOS, FortiGate Cloud, FortiProxy, FortiManager, FortiAnalyzer, FortiWeb, FortiSIEM, and others. Investigation status — ongoing.
Protection recommendations
Updating the kernel followed by a reboot is the only complete solution, as both Red Hat and Canonical stress. Until a patch is installed, temporary measures are available that reduce but do not eliminate the risk:
Filtering IPv4 TCP packets with IP options. Red Hat has published the following nftables rule:
table inet cve_2026_98432 {
chain input {
type filter hook input priority -310; policy accept;
ip protocol tcp ip hdrlength > 5 counter drop
}
}This rule blocks the known attack vector but has limitations: it only operates on the host where it is loaded and does not filter traffic between containers on the same host. In addition, the rule may disrupt applications that use IPv4 options.
Disabling MPTCP is not a sufficient measure. Red Hat explicitly states that MPTCP is not a precondition for the vulnerability — systems with MPTCP disabled remain vulnerable. Canonical confirms: “The Ubuntu Security team considers security updates to be the only adequate mitigation.”
To check the current kernel version, use uname -r and compare the result with the fixed package versions for your distribution.
Given the existence of public PoC code demonstrating the race condition, the critical ratings from most vendors, and the breadth of affected systems — from servers to container platforms — kernel updates should be treated as a priority. RHEL administrators are advised to install the released patches immediately; Ubuntu administrators who cannot wait for -proposed packages to migrate to the main pocket should consider early updates from -proposed, taking into account the risks associated with using a testing pocket.
