OSG-SEC-2026-10-30-CRITICAL-Linux Kernel IPv4 TCP Use-After-Free (CVE-2026-98432)

Dear OSG Security Contacts,

A race condition in the Linux kernel’s IPv4 TCP handling can cause a use-after-free, potentially leading to a kernel crash or memory corruption [1]. An unauthenticated remote attacker who can reach a vulnerable host’s TCP listener may trigger the flaw. Anthropic reports [2] that its proof of concept achieved root command execution on a host with an Multipath TCP(MPTCP) listener; MPTCP is not established as necessary to trigger every vulnerable code path.

IMPACTED VERSIONS:

The issue was introduced upstream in Linux 4.4 [6]; distribution kernels may backport fixes, so check vendor CVE status rather than relying only on the kernel version.

Red Hat lists RHEL 8, 9, 10,with a fix deferred [1]. Ubuntu lists releases as vulnerable or with fixes in progress [3]. Debian trixie has a fix in package version 6.12.113-1 [4].

WHAT ARE THE VULNERABILITIES:

CVE-2026-98432 is a use-after-free race in the Linux kernel’s IPv4 TCP code. An unauthenticated remote attacker who can reach a TCP listener may send specially timed connection requests to trigger the race. Successful exploitation may cause a denial of service, memory corruption, or even root access.

Anthropic reports that its proof of concept took 48 minutes to leak a kernel pointer and another five minutes to reach root command execution.

WHAT YOU SHOULD DO:

Install the vendor-fixed kernel when available and reboot into it. This is the complete fix. Check the vendor status for each distribution; Red Hat reports no suitable mitigation is currently available.

If not needed, disabling MPTCP may reduce exposure to the specific path used in Anthropic’s root command demonstration. However this measure does not replace patching.

If patching is delayed, consider this temporary, non-vendor-supported nftables rule to drop IPv4 TCP packets with IP options [7]: sudo nft add table ip cve_2026_98432 sudo nft 'add chain ip cve_2026_98432 prerouting { type filter hook prerouting priority -300; policy accept; }' sudo nft add rule ip cve_2026_98432 prerouting meta l4proto tcp ip hdrlength gt 5 counter drop Persist it through your firewall manager. Test first: it may disrupt CIPSO/NetLabel traffic and can also drop matching forwarded traffic. This is a stopgap, not a kernel fix. Red Hat does not list it as a supported mitigation.

REFERENCES

[1] https://access.redhat.com/security/cve/cve-2026-98432. [2] https://www.anthropic.com/research/discovering-vulnerabilities-with-claude
[3] https://ubuntu.com/security/CVE-2026-98432. [4] https://lists.debian.org/debian-security-announce/2026/msg00482.html?utm_source=chatgpt.com&pow_referer=
[5] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e3f33b0a1d89d738e2b913dab519226eaf76e15b
[6] https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html?m=1
[7] https://getrff.com/blog/cve-2026-98432-linux-tcp-ip-options-block/#:~:text=CVE%2D2026%2D98432%3A%20how%20to%20block%20the%20Linux%20TCP,read%20the%20options%20after%20they've%20been%20freed.

Please contact the OSG security team at [email protected] if you have any questions or concerns. OSG Security Team