CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation

CVE-2026-98432 is a Linux kernel use-after-free in IPv4 TCP handshake processing. When a request socket becomes a full child socket, both may temporarily refer to the same IP-options object. A concurrent retransmitted-SYN path can read that object inside an RCU read-side section while socket teardown frees it immediately with kfree(). Request migration can create a similar shared-reference race. The stale read may cause a crash or, depending on memory reuse and timing, more serious effects. The upstream fix uses kfree_rcu() in the relevant destructors, postponing reclamation until existing readers have finished. The main ownership-transfer flaw concerns IPv4; IPv6’s ordinary child-creation path copies options, though a separate IPv6 migration concern is noted for CALIPSO.

The CVE’s CVSS 3.1 score of 9.8 reflects a severe network-reachable worst case, while Red Hat’s 5.9 assessment accounts for the race’s difficulty and its products’ conditions. Anthropic demonstrated remote root execution in a controlled lab against a server with an MPTCP listener, but this does not establish widespread exploitation or universal impact across kernels. Disabling unnecessary MPTCP can reduce exposure to that demonstrated scenario, but does not fix the underlying IPv4 flaw. Defenders should inventory reachable Linux networking systems, check vendor-specific advisories and package status rather than relying on kernel version strings, install the corrected vendor build, and reboot into it. MPTCP hosts warrant urgent attention; retransmitted SYN traffic alone is not proof of exploitation.