A critical security flaw, identified as CVE-2026-98432, has been discovered in the Linux kernel's handling of IPv4 TCP connections. The vulnerability is a use-after-free (UAF) bug that occurs during the initial handshake process, before any application-level authentication takes place. It affects any Linux host that accepts IPv4 TCP connections, including web servers, SSH daemons, and Kubernetes nodes. The Linux kernel's own CVE Numbering Authority has assigned the flaw a CVSS score of 9.8, categorizing it as a critical risk because it can be reached by a remote, unauthenticated peer.

The technical root cause lies in how the kernel manages 'request sockets' during a TCP handshake. When a connecting peer includes IPv4 options in its header, the kernel saves these options to echo back in its replies. The bug occurs because the kernel transfers ownership of these options to a new connection socket without copying them, then immediately frees the memory. If another CPU core concurrently attempts to read that memory to build a handshake reply, it accesses freed kernel memory. This can lead to kernel heap memory disclosure, out-of-bounds writes, or a system crash. Anthropic researchers reported that an AI model successfully generated a proof-of-concept exploit capable of executing arbitrary commands as root on servers running a multipath TCP (MPTCP) listener.

A diagram illustrating the Transmission Control Protocol (TCP) handshake process.
The TCP handshake process is where the vulnerability occurs before application-level authentication.ja.wikipedia.org

This image illustrates the TCP handshake process described in the technical root cause section.

A visual representation of the TCP connection start sequence.
The initial handshake phase is the specific point of failure for the CVE-2026-98432 bug.ja.wikipedia.org

This visual supports the explanation of the initial handshake process mentioned in the second paragraph.

While the upstream fix involves changing `kfree()` calls to `kfree_rcu()` to ensure memory is only released after all readers have finished, the availability of the patch varies by distribution. As of late October 2026, several major platforms like Ubuntu and Red Hat (RHEL 8, 9, and 10) have not yet published fixes for their respective kernels. For systems that cannot be patched immediately, security researchers suggest an interim mitigation: dropping TCP packets that carry IPv4 options. Since legitimate TCP traffic rarely uses these options, such a rule can be implemented at the firewall level to block the specific path used by the vulnerability without impacting standard connections.