CVE-2026-98432 is a Linux kernel use-after-free vulnerability in IPv4 TCP option handling, rated critical with a CVSS score of 9.8 and high Ubuntu priority. When a TCP connection is being established, a child socket can inherit request-socket options without copying them. Meanwhile, another CPU may still read those options while building a SYN-ACK. If the socket is freed before those reads finish, the kernel can access freed memory. A related race occurs when request sockets are migrated: the original and its clone share the options, and freeing either one can invalidate data still in use by the other.
The kernel fix changes the freeing of these option structures to wait for an RCU grace period, matching the protection already used by readers and other option-replacement paths. The first race does not affect IPv6 because its connection path duplicates options, though a similar migration issue involving IPv6 options remains for separate correction. Ubuntu’s status shows vulnerability across many kernel packages and releases, including supported releases where fixes are still in progress, as well as several older or specialized kernels marked vulnerable. Ubuntu 14.04’s standard Linux kernel is listed as not affected; some package variants are not present, superseded, or outside support. The status varies by kernel flavor and release, so it is not accurate to treat every Ubuntu installation as equally affected.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
CVE-2026-98432 is a network-reachable use-after-free in Linux’s IPv4 TCP handshake, with researchers demonstrating remote root code execution in a lab using an MPTCP listener. Administrators should inventory exposed Linux services, prioritize MPTCP hosts, install their vendor’s fixed kernel, and reboot into it. (penligent.ai)
Arken is passwordless authentication middleware that verifies decentralized identity signatures made with secp256k1 keys. It is designed to work without passwords or server-side sessions. (github.com)
Go 1.24 enables Multipath TCP by default for Linux listening sockets, exposing servers to attacks involving Linux kernel CVE-2026-98432. Go offers settings to disable MPTCP, but recommends upgrading to a patched kernel because disabling it per program is an unreliable fix. (groups.google.com)
Highway thieves have stolen more than $100 million in data center equipment since June using hacked freight accounts, fake drivers, and GPS spoofing. Targets include servers, fiber-optic cables, chips, copper wire, and power equipment. (arstechnica.com)
Arkham’s explorer page identifies an entity called “Binance-hacker-1029” and attributes $5.6 billion in theft from Binance to it. The attribution is an unverified claim, not proof that the funds were stolen. (arkm.com)
Unconfirmed reports say a Binance wallet was drained into a new address, with the transaction funded through Tornado Cash. Posts later claimed as much as $3 billion may have been extracted, but the incident remains unverified. (twitter.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.