TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
On October 11 and 15, 2026, Linux stable kernels released a patch for CVE-2026-98432, a critical use-after-free vulnerability in the IPv4 TCP handshake. The flaw could be exploited by a remote, unauthenticated peer to leak kernel memory, manipulate kernel writes, or even crash the system. The affected kernels range from 4.4 to the latest versions, including 7.3 and 7.2.10.
Although the upstream fix is a minimal four-line change, most servers run a distribution kernel, and as of October 29, Ubuntu still marked its kernel as vulnerable, while Red Hat listed RHEL 8, 9, and 10 as affected with no fix. The bug arises when the kernel handles options in IPv4 headers, which are kept and echoed in replies.
The kernel hands those saved options without copying them, then immediately frees them, leaving stale data that can be read by another CPU. Anthropic's researcher, Claude, demonstrated a working PoC exploit that runs commands as root on Linux servers with a multipath TCP listener, requiring no credentials. The vulnerability affects any Linux kernel from 4.4 onwards, whether it serves the network directly or hosts containers, as containers run on the host kernel.
Distribution kernels carry backported fixes under their own version numbers, so checking the tracker is essential. Mitigation includes updating to the fixed kernel, installing distribution patches, and dropping TCP packets with IPv4 options at edge firewalls.
Written by urgent.news from Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
