Critical Linux Kernel IPv4 TCP | CVE-2026-98432

BY | Nov 2, 2026 | Linux

CVE-2026-98432: Critical Linux Kernel IPv4 TCP Use-After-Free

CVE-2026-98432 is a critical use-after-free race condition in the Linux kernel’s IPv4 TCP connection handshake path. It affects kernels from roughly 4.4 onward (introduced by commit 079096f103fa) and carries a CVSS score of 9.8.

A remote, unauthenticated attacker who can reach a listening TCP socket can trigger the flaw by sending carefully timed TCP SYN packets that carry IPv4 options. This can crash the kernel, corrupt memory, or (under specific conditions such as an MPTCP listener) potentially lead to remote code execution. The bug only fires when the initial packet includes IP options — something almost never present in normal traffic.

What You Should Do

Best Fix

Update the Kernel

Apply the fixed kernel package from your distribution and reboot. Fixed versions include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and mainline 7.3+. Check your distro’s security advisories.

Temporary Mitigation

Drop Packets with IP Options

Until you can update, drop incoming IPv4 TCP packets that contain IP options. Normal traffic is unaffected. The systemd unit below makes this persistent across reboots.

Additional Hardening

Disable MPTCP

If you do not use Multipath TCP, disable it. This reduces the conditions used in published RCE demonstrations but does not fully fix the underlying race.

Temporary Mitigation (nftables + systemd)

Create the nftables ruleset

Save the following as /etc/nftables/cve-2026-98432.nft (create the directory if needed):

table inet cve_2026_98432 {
    chain input {
        type filter hook input priority -310; policy accept;
        ip protocol tcp ip hdrlength > 5 counter drop
    }
}

Create the systemd unit

Run this to create the service file:

sudo tee /etc/systemd/system/cve-2026-98432.service >/dev/null <<'EOF'
[Unit]
Description=Drop IPv4 TCP packets with IP options (CVE-2026-98432 mitigation)
Wants=network-pre.target
Before=network-pre.target
After=sys-subsystem-net-devices-*.device

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/sbin/nft -f /etc/nftables/cve-2026-98432.nft
ExecStop=/usr/sbin/nft delete table inet cve_2026_98432

[Install]
WantedBy=multi-user.target
EOF

Enable and start it

sudo systemctl daemon-reload
sudo systemctl enable --now cve-2026-98432.service

Verify with sudo nft list table inet cve_2026_98432. The counter will show dropped packets (should stay near zero under normal traffic).

Additional Temporary Mitigation: Disable MPTCP

Disable MPTCP immediately

sudo sysctl -w net.mptcp.enabled=0

This takes effect immediately. Verify with sysctl net.mptcp.enabled (should show 0).

Make it persistent across reboots

echo 'net.mptcp.enabled=0' | sudo tee /etc/sysctl.d/99-disable-mptcp.conf
sudo sysctl --system

Only do this if you do not rely on Multipath TCP. Re-enable later with net.mptcp.enabled=1 if needed after the kernel is patched.

Removal After Kernel Update

Remove the nftables mitigation

sudo systemctl disable --now cve-2026-98432.service
sudo rm /etc/systemd/system/cve-2026-98432.service
sudo rm /etc/nftables/cve-2026-98432.nft
sudo systemctl daemon-reload

Only remove this after you have updated the kernel and rebooted into a fixed version.

Re-enable MPTCP if you disabled it

sudo rm /etc/sysctl.d/99-disable-mptcp.conf
sudo sysctl -w net.mptcp.enabled=1
sudo sysctl --system

Skip this if you intentionally want MPTCP left off.

Questions for the Community

Have you applied the mitigation or a kernel update yet?

Which distribution and kernel version are you running?

Any issues with the nftables rule?

Did you see unexpected drops or other side effects on your network?

Alternative approaches

Are you using firewalld, iptables, or another method to achieve the same protection?

These steps are temporary only. The correct long-term fix is updating to a patched kernel. Test the rule and sysctl change in a non-production environment first, and monitor the nftables counter after deployment.

Disclaimer

This content is for educational and informational purposes only. It is not technical advice. Security configurations should be tested thoroughly in your environment. Always verify official advisories from your distribution and apply official kernel updates as soon as they become available.

DISCUSSION

No replies yet. Be the first to join the discussion!