Use-after-free in Linux kernel - CVE-2026-98432

Vulnerability details

The vulnerability allows a remote attacker to potentially cause a denial of service by triggering access to freed IPv4 socket options.

The vulnerability exists due to use-after-free in the Linux kernel IPv4 TCP socket option handling when socket destruction frees shared options while another CPU is still using them to build a SYNACK or create a child socket. A remote attacker can send TCP traffic that encounters these concurrent processing paths to potentially cause a kernel crash.

The request socket migration path requires net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program. IPv6 is not affected by the child socket ownership-transfer path because it duplicates the options.

Affected software

How to mitigate CVE-2026-98432

External References

• https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568
• https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936
• https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a
• https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036
• https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5
• https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2
• https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6
• https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b

Related Security Bulletins

• Use-after-free in Linux kernel ipv4
• Debian update for linux