Linux kernel CVE-2026-98432 enables unauthenticated RCE
Original title: Linux kernel RCE CVE-2026-98432
The race condition in TCP SYN handling for IPv4 allows unauthenticated remote code execution in the Linux kernel.
Fortinet PSIRT reports CVE-2026-98432 with a CVSSv3 score of 9.8 in the Linux kernel. The flaw occurs when tcp_v4_syn_recv_sock transfers ownership of ireq->ireq_opt to the child socket without copying it. Another CPU can process a retransmitted SYN concurrently, leading to a race condition under rcu_read_lock that enables arbitrary code execution.
- CVSSv3 score of 9.8
- Race condition frees inet_opt and ireq_opt after RCU grace period
- Concurrent SYN processing can trigger ip_options_build()
- No specific affected kernel versions stated
- No fixed version provided
Impact: unauthenticated remote code execution in Linux kernel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×25 |
From the original article
CVSSv3 Score: 9. 8 CVE-2026-98432:ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req().
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.