CVE-2026-98432

Name of the Vulnerable Software and Affected Versions Linux kernel versions 4.4 through 5.10.271 Linux kernel versions 5.15 through 5.15.222 Linux kernel versions 6.1 through 6.1.189 Linux kernel versions 6.6 through 6.6.158 Linux kernel versions 6.12 through 6.12.112 Linux kernel versions 6.18 through 6.18.55 Linux kernel versions 7.2 through 7.2.9 Linux kernel versions 7.3 through 7.3-rc6

Description A race-condition-induced use-after-free issue exists in the IPv4 TCP stack. The tcp v4 syn recv sock() function transfers ownership of ireq->ireq opt to a child socket without copying it. If the child socket is freed while another CPU is processing a retransmitted SYN and building a SYNACK, the kernel may read freed memory in ip options build(). A similar issue occurs during request socket migration when reqsk timer handler() clones a request socket and reqsk migrate reset() clears the pointer in the old one. This flaw can be exploited by an unauthenticated remote attacker to leak kernel memory, bypass KASLR (Kernel Address Space Layout Randomization), and execute arbitrary commands as root, particularly on servers running a Multipath TCP (MPTCP) listener. The attack requires crafted IPv4 TCP packets with IP options.

Recommendations Update the Linux kernel to versions 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, or 7.3 and later. As a temporary mitigation, disable MPTCP by setting net.mptcp.enabled=0 via sysctl. As a temporary mitigation, use a firewall to drop incoming IPv4 TCP packets that contain IP options (header length above 5). For applications built with Go 1.24+, run the program with the environment variable GODEBUG=multipathtcp=0 to disable MPTCP listeners.