Scope
CVE-2026-98432 concerns Linux IPv4 TCP option lifetimes and an RCU fix. Verified on 2026-11-04, this material is for developers and operators who need to inventory kernels, assess backports or review AI patch suggestions.
IPv4 TCP race and RCU fix
Rank 01/02
CVE-2026-98432Linux CNA vulnerability record
Use-after-free of IPv4 options
Describes the lifetime problem when a TCP child socket and request socket share an option pointer, and lists the score, version ranges and fix commits.
- Linux
- IPv4
- TCP
- RCU
Rank 02
torvalds/linuxEric Dumazet's upstream fix
Free options after an RCU grace period
Uses kfree_rcu in two IPv4 destructor functions. Check both the child socket and request socket paths in the target branch.
- patch
- backport
According to the Linux CNA record, tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket without copying the options. Another CPU can concurrently process a retransmitted SYN and build a SYNACK; if the child socket has freed the options, ip_options_build() may read freed memory.
Request socket migration has a similar lifetime problem with shared options, involving net.ipv4.tcp_migrate_req=1 or BPF_SK_REUSEPORT_SELECT_OR_MIGRATE. Patching only one free site leaves the other path uncovered.
| Item | Official record and limits |
|---|---|
| CVSS | 9.8, Critical, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; the original HTML's AC:H differs |
| Child socket | inet_sock_destruct() in net/ipv4/af_inet.c switches to kfree_rcu() |
| Request socket | tcp_v4_reqsk_destructor() in net/ipv4/tcp_ipv4.c switches to kfree_rcu() |
| Impact evidence | The CNA describes kernel-data disclosure, out-of-bounds writes, potential control-flow corruption and kernel panic; these descriptions do not establish reliable root RCE or KASLR bypass |
| IPv6 scope | The first child socket issue does not affect IPv6; the CNA also describes a CALIPSO-related request socket migration issue addressed by a separate patch |
Fixed versions by kernel branch
Rank 01
Linux kernel CVE version rangesCheck fixed versions by branch
Verify upstream versions and distribution packages separately
The CNA lists the first unaffected version in each branch. Distributions may backport fixes; also check their security advisories and the kernel package actually running.
- version ranges
- vendor advisory
The CNA records 4.4 as the introduction version. Check fixed versions against the corresponding kernel branch.
| Kernel branch | First fixed version listed by the CNA |
|---|---|
5.10 | 5.10.272 |
5.15 | 5.15.223 |
6.1 | 6.1.190 |
6.6 | 6.6.159 |
6.12 | 6.12.113 |
6.18 | 6.18.56 |
7.2 | 7.2.10 |
| Mainline | 7.3 |
For example, upstream 6.1.189 is below this record's 6.1.190 fix threshold; distribution kernels also require a backport-status check. The Ubuntu CVE page is an entry point for checking that distribution. It does not establish that other distributions or every package are fixed.
AI patch review prompts
Rank 01/01
Evidence-based kernel review promptsConstrain model output with the official patch
Verify sources before reviewing the target branch
Supply the upstream commit, target kernel source and distribution information. Require the model to separate verified facts, proposed tests and work not yet performed.
- prompt
- code review
Use either prompt with a coding agent that can read source code and reference documents. First supply the target kernel tree, branch or commit, kernel configuration and distribution advisory; require the model to report missing inputs.
Full review version
Review CVE-2026-98432 for the supplied Linux kernel source tree.
Evidence:
- CVE record: https://cveawg.mitre.org/api/cve/CVE-2026-98432
- Upstream fix: e3f33b0a1d89d738e2b913dab519226eaf76e15b
- Patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/patch/?id=e3f33b0a1d89d738e2b913dab519226eaf76e15b
Read the evidence and the target tree before proposing changes.
If the tree, revision, configuration or vendor advisory is unavailable,
list the missing evidence and stop the patch proposal.
Trace the ownership and RCU readers of inet_opt and ireq_opt.
Check inet_sock_destruct() and tcp_v4_reqsk_destructor().
Determine whether an equivalent fix is already present.
If a backport is needed, base it on the verified upstream patch and
explain any target-branch differences. Do not invent a replacement fix.
Return:
- Evidence links and the target revision reviewed.
- Affected, fixed or undetermined status, with supporting code locations.
- A proposed diff only if the target requires it; do not apply it.
- Build, regression and RCU-lifetime checks appropriate to that tree.
- Rollback requirements and any remaining uncertainties.
Separate tests actually run from tests only proposed.
Do not claim reliable root RCE, KASLR bypass or a validated mitigation
without evidence. Do not deploy, reboot or change firewall/sysctl settings.Concise review version
Audit CVE-2026-98432 in the supplied Linux kernel tree.
Verify https://cveawg.mitre.org/api/cve/CVE-2026-98432 and upstream
commit e3f33b0a1d89d738e2b913dab519226eaf76e15b first.
Check inet_sock_destruct() and tcp_v4_reqsk_destructor() for an
equivalent RCU-safe fix. Report evidence, target revision and status.
Propose a branch-specific backport only when needed and supported.
List missing inputs instead of guessing. Separate executed tests from
proposed tests. Do not apply changes, deploy or alter host settings.Model output requires human review. The stable kernel rules require a fix or equivalent fix to exist upstream and be tested; a model-generated diff still needs builds and regression checks for the target branch.
Temporary measures and evidence limits
Rank 01
Linux MPTCP sysctl documentationScope of the MPTCP switch
Controls MPTCP socket creation
enabled controls whether MPTCP sockets can be created. This documentation does not establish that disabling MPTCP blocks the ordinary IPv4 TCP path in CVE-2026-98432.
- MPTCP
- mitigation limits
| Original advice | Verification result | Operating rule |
|---|---|---|
| Disable MPTCP | The official sysctl documentation covers MPTCP socket creation; the CVE record does not list this switch as a fix | Do not treat disabling MPTCP as a fix or a validated mitigation |
| Use iptables to filter SYN packets with IP options | The official CVE record, patch and documents fetched for this review do not validate the original rule's coverage | Do not apply that rule directly in production; packet, protocol and availability checks are still required |
| Ask a model to produce a production patch directly | Without the target branch, backport status and test results, applicability cannot be determined | Collect evidence, then review against the official fix and target source code |
Response paths by maintenance context
Distribution kernel
Check the vendor advisory and running version
Inventory kernel packages, the running version and vendor backport records. Schedule updates, verification and a recovery plan through the existing maintenance process.
Custom kernel
Review the official patch and target branch
Check both destructor functions and RCU lifetimes. Complete builds and regression checks in an isolated environment before assessing deployment.
Insufficient information
Collect patch evidence
Mark the status as undetermined and collect the kernel commit, configuration and vendor advisory. Do not declare a fix based on a model answer or an unverified packet rule.