A security vulnerability identified as CVE-2026-98432 affects the Linux kernel's handling of IPv4 TCP handshake requests. The issue centers on how the kernel manages the ownership and reclamation of IP options data. During a standard TCP handshake, the kernel creates a lightweight 'request socket' to store initial connection state. As the handshake progresses to a full 'child socket,' the kernel transfers the pointer to the request socket's IP options (`ireq_opt`) to the child socket's options (`inet_opt`) rather than duplicating the object. This design choice means both socket objects share the same memory allocation for their options.
The vulnerability manifests as a race condition when a retransmitted SYN packet arrives for the same connection. Because Linux networking is highly parallel, a second CPU may process this retransmitted SYN while the first CPU is completing the handshake. The second CPU enters an RCU (Read-Copy Update) read-side critical section to build a SYN-ACK response, reading the shared IP options. However, if the child socket is destroyed during this window, the kernel's original destructor uses a standard `kfree()` call. Unlike RCU-aware reclamation, `kfree()` makes the memory available for reuse immediately. This creates a use-after-free scenario where the second CPU continues to read from memory that may have already been reallocated to a different kernel object, potentially leading to a crash, data disclosure, or remote code execution.
This diagram explains the specific race condition where a second CPU reads shared IP options while the first CPU handles the socket destruction.
The upstream fix, merged as commit `e3f33b0a1d89`, replaces the immediate `kfree()` with `kfree_rcu()`. This ensures that the memory reclamation is delayed until an RCU grace period has elapsed, guaranteeing that all CPUs currently holding a reference to the options object have finished their operations. While the primary vulnerability affects the IPv4 child-socket path, a related issue exists in request socket migration (when `net.ipv4.tcp_migrate_req=1` is enabled). In that case, the kernel clones the request socket, and the old request and its clone share the same options. The patch addresses both the standard child-socket path and the migration path by enforcing RCU-aware reclamation in both `inet_sock_destruct()` and `tcp_v4_reqsk_destructor()`.
This image provides a visual workflow for the remediation steps described in the context of the kernel patch.