CVE-2026-98432 reveals a use-after-free vulnerability in the Linux kernel's IPv4 TCP handshake path. The flaw occurs when two processors act on related request and child sockets, allowing one path to free an IP options object while another path, protected only as an RCU reader, continues to use it. This results in a stale kernel pointer reachable through network traffic.
The vulnerability carries a CVSS 3.1 score of 9.8, representing a worst-case network-reachable, unauthenticated impact on confidentiality, integrity, and availability. However, Red Hat assigns a lower severity of 5.9, treating exploitation as a difficult race with conservative practical consequences. Separately, Anthropic's Frontier Red Team demonstrated a working remote root code-execution chain against a Linux server with a Multipath TCP listener in a controlled lab environment.
The upstream fix replaces immediate freeing with kfree_rcu() in relevant destructors to delay reclamation until RCU readers complete. Defenders should identify reachable Linux TCP services, determine the specific vendor kernel running, and install the vendor-provided fixed build. Hosts exposing Multipath TCP listeners deserve immediate attention due to validated research exploitability, while internet-facing gateways and load balancers should perform fast inventory checks even without intentional MPT CP enablement.
Source: Hacker News · Summarized by HeadlinesBriefing