Linux kernel TCP use-after-free CVE-2026-98432 can crash Ubuntu
Original title: Critical Linux Kernel Vulnerability Lets Remote Attackers Crash Ubuntu Systems
Ubuntu lists kernels through 22.04 LTS as affected, with fixes still in progress and no confirmed exploitation.
Ubuntu’s advisory, first issued October 15 and updated October 29, describes CVE-2026-98432, a use-after-free in IPv4 TCP connection handling scored CVSS 9.8. The flaw is in tcp_v4_syn_recv_sock(), where shared IP options can be freed while another CPU still reads them, which can crash the system. The published description does not give a reliable remote exploit or confirm attacks. Fixes that defer freeing with kfree_rcu() are in progress and are not released security updates.
Unconfirmed: The published description does not confirm a reliable remote exploit or active exploitation.
- CVSS score assigned to CVE-2026-98432 is 9.8.
- Ownership of ireq_opt is transferred without copying the underlying IP options.
- The fix uses kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor().
- Generic kernels for Ubuntu 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS are listed.
- A related race involves tcp_migrate_req=1 or BPF_SK_REUSEPORT_SELECT_OR_MIGRATE.
Impact: Kernel crash and service disruption via freed TCP options
| Product | Affected |
|---|---|
| Ubuntu Linux kernel | Generic kernels for 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS; older releases and cloud kernel variants |
- 1.Track Ubuntu kernel updates; listed target builds are not released security fixes.
- CVEs
- CVE-2026-98432
- Vendors
- Ubuntu
- Products
- Linux kernel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×15 |
From the original article
2 min read at gbhackers.com
A critical vulnerability in the Linux kernel, identified as CVE-2026-98432, threatens Ubuntu systems through a networking memory flaw that could cause crashes and service disruptions. Ubuntu released an advisory on October 15, 2026, and provided an update on October 29. The vulnerability has been assigned a CVSS severity score of 9.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.