A Flaw in the Linux Kernel’s TCP/IPv4 Implementation

CVE-2026-98432 is a use-after-free flaw in the Linux kernel’s TCP/IPv4 connection handling. It can cause kernel memory corruption, crashes and, under specific conditions, unauthenticated remote code execution. Red Hat rates it Critical. Prioritise exposed Linux TCP listeners and install the corrected kernel for your distribution.

Vendor status checked on November 1, 2026.

What goes wrong during TCP connection setup?

During connection setup, tcp_v4_syn_recv_sock() transfers IPv4 options from the request socket (ireq_opt) to the child socket (inet_opt) without copying them. Another CPU can process a retransmitted SYN and read those same options while building a SYN-ACK.

If the child socket is destroyed before that read finishes, its destructor frees the options. The other CPU then accesses freed memory: a use-after-free. Request-socket migration has a related memory-lifetime problem.

The fix uses kfree_rcu() to defer freeing until an RCU grace period has passed, allowing existing readers to finish.

Time flows downward. The dashed block is the same allocation after freeing; the RCU fix appears on the right.

What has been demonstrated?

Anthropic’s October 27 research demonstrated remote command execution as root against a Linux server with a Multipath TCP (MPTCP) listener. The Go Security Team notes that the underlying bug also affects other TCP paths. Disabling MPTCP reduces exposure to that demonstrated attack; a kernel update addresses the defect.

Vendor patch status on November 1, 2026

Debian’s numbers above are source-package versions, not expected uname -r output. Match your running kernel to the vendor’s corrected build; backports can retain an older upstream version.

Check exposure and apply the fix

1. Identify the host and its TCP listeners

On each Linux host, run:

cat /etc/os-release
uname -r
sudo ss -4 -ltnp

Start with internet-facing listeners, especially MPTCP services. Include VPS instances, container hosts, Kubernetes workers and origins reachable directly behind a load balancer. Review internal listeners reachable by untrusted tenants too.

For sockets bound to 0.0.0.0 or a public address, trace access through the host firewall, cloud security groups and forwarding rules. To review MPTCP, run sysctl net.mptcp.enabled and check the application’s listener configuration.

2. Install the corrected kernel

Use your distribution’s security repository or patched node image. On Amazon Linux, AWS provides these commands; run the one for your release:

# Amazon Linux 2
sudo yum update kernel

# Amazon Linux 2023
sudo dnf update kernel --releasever=latest

Then reboot during the maintenance window. For a redundant service, update and verify one node before continuing through the fleet. Update launch images and templates so new nodes also receive the fix.

For ordinary containers, patch the host kernel. EKS and ECS have separate node-image and rollout instructions in the AWS bulletin.

3. Confirm the new kernel is running

After reboot or node replacement:

1. Run uname -r and match it to the vendor’s corrected kernel build.
2. Check application health, TCP listeners and load-balancer registration.
3. Record any nodes still awaiting an update or reboot.

Temporary controls while a kernel fix is pending

Red Hat’s bulletin provides an nftables rule to drop incoming IPv4 TCP packets containing IPv4 options. Test it against your workloads before rollout. This reduces exposure but does not fully prevent exploitation. IPv4 options and TCP options are in different headers; ordinary TCP options remain permitted by that rule.

For Go services, GODEBUG=multipathtcp=0 disables MPTCP by default. Explicit per-socket settings can override it. Use this only as a temporary measure while arranging the kernel update.

Related infrastructure guides: IPv4 for hosting providers and IPv4 leasing.