Use-after-free in Linux kernel - CVE-2026-98432

Vulnerability details

The vulnerability allows a remote attacker to potentially cause a denial of service through access to freed IPv6 request socket options.

The vulnerability exists due to use-after-free in tcp_v6_reqsk_destructor() when request socket migration leaves concurrent processing using shared options after they have been freed. A remote attacker can send TCP traffic that encounters concurrent request socket migration and destruction to potentially cause a kernel crash.

The affected ipv6_opt options are only set by CALIPSO.

Affected software

How to mitigate CVE-2026-98432

External References

• https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568
• https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936
• https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a
• https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036
• https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5
• https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2
• https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6
• https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b

Related Security Bulletins

• Use-after-free in Linux kernel ipv4
• Debian update for linux