A recently disclosed vulnerability (CVE-2026-98432) affects the Linux kernel IPv4 TCP networking subsystem and may allow an unauthenticated remote attacker to potentially execute arbitrary code on vulnerable systems.
Severity level:
CVSS Score: 9.8/Critical
Description:
CVE-2026-98432 is a use-after-free vulnerability caused by a race condition during the processing of IPv4 TCP connection requests. A remote attacker can send specially timed TCP packets containing IP options to trigger memory corruption while the kernel processes retransmitted connection requests or socket migrations. Successful exploitation may cause a kernel crash, expose kernel memory, or potentially allow arbitrary code execution.
Affected Versions:
- Linux kernel versions 4.4 and later that do not include the vendor provided fix for the vulnerability.
Impact:
Successful exploitation may allow attackers to execute arbitrary code with kernel- level privileges under exploitable conditions.
Resolution:
Apply the latest kernel security update provided by the applicable Linux distribution and reboot the system to load the corrected kernel.
Reference:
https://www.cyber.gc.ca/en/alerts-advisories/linux-security-advisory-av26-1108
https://nvd.nist.gov/vuln/detail/cve-2026-98432
https://www.cve.org/CVERecord?id=CVE-2026-98432
https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html
UIT Information Security