CVE-2026-98432: IPv4 request-socket options (inet_opt / ireq_opt) in tcp_v4_syn_recv_sock and request-socket migration
IPv4 options shared between a TCP request socket and its child (or a migrated clone) were freed with plain kfree() while another CPU could still be building a SYN-ACK from them, causing a use-after-free in ip_options_build(). Red Hat rates it Critical because a remote, unauthenticated attacker could get kernel memory corruption or code execution with precise timing. AWS says researchers demonstrated unauthenticated RCE against hosts with an MPTCP listener. The fix defers the frees with kfree_rcu().
Executive Summary & Technical Impact
IPv4 options shared between a TCP request socket and its child (or a migrated clone) were freed with plain kfree() while another CPU could still be building a SYN-ACK from them, causing a use-after-free in ip_options_build(). Red Hat rates it Critical because a remote, unauthenticated attacker could get kernel memory corruption or code execution with precise timing. AWS says researchers demonstrated unauthenticated RCE against hosts with an MPTCP listener. The fix defers the frees with kfree_rcu().
Tracked under CVE-2026-98432 (CWE-416 (Use After Free)), this vulnerability affects Linux kernel 4.4 and later before the fixed stable releases; RHEL 8/9/10, OpenShift and Ubuntu 22.04/24.04/26.04 unfixed as of 2026-11-01 and carries a severity score of 9.8 (CVSS 3.1, Linux kernel CNA) (CRITICAL). Engineering and security operations teams running Linux kernel (IPv4 TCP stack) should prioritize upgrading to Upstream 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3; Debian bookworm 6.1.190-1, trixie 6.12.113-1; Amazon Linux 2/2023 updated kernels.
Remediation & Patch Guidance
- Install your distribution's fixed kernel and reboot. Confirm with uname -r.
- Until a fixed kernel is available (RHEL, Ubuntu), drop inbound IPv4 TCP packets with IP options, e.g. Red Hat's nftables rule "ip protocol tcp ip hdrlength > 5 drop" at priority -310.
- Disable MPTCP where unused (net.mptcp.enabled=0, or GODEBUG=multipathtcp=0 for Go 1.24+ services).
- Refresh EKS/ECS node images to the 20261031 AMIs or later. Prioritize Linux targets behind L4 load balancers, which pass IP options through.
Frequently Asked Questions (CVE-2026-98432)
What versions are affected by CVE-2026-98432?
CVE-2026-98432 affects Linux kernel 4.4 and later before the fixed stable releases; RHEL 8/9/10, OpenShift and Ubuntu 22.04/24.04/26.04 unfixed as of 2026-11-01 in Linux kernel (IPv4 TCP stack) (IPv4 request-socket options (inet_opt / ireq_opt) in tcp_v4_syn_recv_sock and request-socket migration).
How do I patch or remediate CVE-2026-98432?
Upgrade affected deployments to Upstream 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3; Debian bookworm 6.1.190-1, trixie 6.12.113-1; Amazon Linux 2/2023 updated kernels and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-98432?
CVE-2026-98432 is rated CRITICAL with a CVSS score of 9.8 (CVSS 3.1, Linux kernel CNA) (vector: Network, unauthenticated; crafted IPv4 TCP packets carrying IP options race SYN/SYN-ACK processing (AWS reports demonstrated RCE against MPTCP listeners)).
Linux Kernel CVE-2026-98432: A Remote, Unauthenticated Use-After-Free in the IPv4 TCP Handshake
A CVSS 9.8 race in how the kernel frees IPv4 options during connection setup affects kernels from 4.4 onward. Debian and Amazon Linux have fixes; RHEL and Ubuntu kernels were still pending on November 1.
Read full engineering post-mortem (6 min read) →