Linux TCP use-after-free CVE-2026-98432 yields lab remote root
Original title: CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation
Upstream CVSS is 9.8 and Red Hat scores 5.9; Anthropic’s root chain used a lab Multipath TCP listener.
CVE-2026-98432 is a use-after-free in the Linux kernel IPv4 TCP handshake when one CPU frees shared IP options with kfree while another still reads them under RCU. The upstream fix, commit e3f33b0a1d89, delays reclamation with kfree_rcu in the relevant destructors, including a request-migration case. Anthropic’s Frontier Red Team reported remote root code execution against a controlled server with an MPTCP listener. No source cited here shows widespread exploitation on the public internet.
Unconfirmed: No cited source establishes widespread exploitation, and Red Hat’s 5.9 score disagrees with the upstream 9.8 rating.
- The main IPv4 ownership bug does not apply to ordinary IPv6 child-socket creation.
- An IPv6 request-migration issue involving CALIPSO is handled separately.
- Migration matters when net.ipv4.tcp_migrate_req=1 or a BPF reuseport program migrates requests.
- Ubuntu tracks fixes per kernel flavor, so a generic version check is not enough.
Impact: Remote root code execution against a lab MPTCP host
| Product | Affected |
|---|---|
| Linux kernel | — |
- 1.Install the vendor-provided fixed kernel and reboot into it
- 2.Prioritize hosts that expose Multipath TCP listeners
- CVEs
- CVE-2026-98432
- Vendors
- Red Hat
- Products
- Linux kernel
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×15 |
From the original article
13 min read at penligent.ai
CVE-2026-98432 is a use-after-free in the Linux kernel’s IPv4 TCP handshake path. The flaw appears when two processors act on related request and child sockets while both can still reference the same IP options object. One path may free that object immediately while another path, protected only as an RCU reader, continues to use it.
By cobychapple · penligent.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.