CVE-2026-98432 use-after-free in Linux TCP IPv4 handshake enables unauthenticated remote root via MPTCP
Vendor CVSS scores diverge sharply from the kernel team's 9.8, exposing patch lag in major distributions. The flaw's introduction in 4.4 and selective IPv6 mitigation reveal long-standing asymmetry in TCP option handling. Immediate risk is limited to MPTCP-enabled listeners but the use-after-free pattern warrants broader audit of socket teardown paths.
The race occurs when IPv4 Record Route or Timestamp options from a SYN are passed to the new socket without copy, allowing a freed pointer read if the socket is destroyed mid-handshake on another CPU. Upstream fix landed October 5 in 4.4+ kernels, adding RCU protection before kfree, yet the CVE record omits any MPTCP reference despite Anthropic's October 27 report tying the vector to multipath sockets. Debian, Oracle, SUSE, and Amazon shipped updates by October 29 while Ubuntu and RHEL list the issue high or important with fixes deferred and no dates.
Red Hat: No RHEL 9 advisory by November 15, leaving 60% of production instances exposed past 30 days post-disclosure.
Sources (2)
- [1]Primary Source(https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html)
- [2]Supporting Source(https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fix-tcp-ipv4-options-rcu)