Linux TCP Use-After-Free CVE-2026-98432: CVSS 9.8
Original: TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
Why This Matters
Unauthenticated root RCE on any unpatched Linux server accepting TCP is as bad as it gets.
CVE-2026-98432 is a remote, unauthenticated use-after-free in Linux's IPv4 TCP handshake scoring CVSS 9.8. Fixed upstream Oct 15, 2026; Ubuntu and RHEL still unpatched as of Oct 31.
CVE-2026-98432, dubbed 'ipv4: free inet_opt and ireq_opt after an RCU grace period,' is a critical use-after-free flaw in the Linux kernel's IPv4 TCP handshake path—code every Linux server runs before any application touches an incoming connection. The Linux kernel CNA scores it CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The bug traces back to Linux 4.4. Fixed kernel versions include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3, shipped Oct 11–15. The upstream fix is just four lines of code. Anthropic reported the vulnerability and says its Claude model produced a working proof-of-concept exploit achieving root command execution on Linux servers running a multipath TCP listener—no credentials required. The Go Security Team confirmed Go programs open multipath TCP listeners by default, widening the attack surface significantly. As of Oct 31, Ubuntu's tracker marks all releases 'Vulnerable' and RHEL 8, 9, and 10 remain unpatched. Debian, current SUSE Enterprise, Oracle UEK, and Amazon Linux have issued fixes. Interim mitigations include dropping TCP packets carrying IPv4 options and disabling multipath TCP where unused.