CVE-2026-98432: Linux Kernel IPv4 TCP UAF Deep Dive

I updated a server kernel this week and noticed a fix for a race I hadn’t heard about. CVE-2026-98432 is a use-after-free in the IPv4 TCP handshake that lets an unauthenticated remote attacker read freed kernel memory and run commands as root (CVSS 9.8, Linux 4.4 through 7.2.9).

Official commit – Akamai analysis – Red Hat advisory

Root cause
When a TCP handshake starts, the kernel stores IP options from the SYN in ireq->ireq_opt on the request socket. In tcp_v4_syn_recv_sock(), ownership of this pointer transfers to the child socket without copying. Since Linux 4.4 (commit 079096f103fa), request sockets are processed without the listener lock, so a retransmitted SYN arriving on another CPU can trigger inet_sock_destruct() far enough to free inet_opt via plain kfree() while ip_options_build() still reads it for the SYN-ACK — a use-after-free.

A similar race exists via request socket migration (net.ipv4.tcp_migrate_req=1). The fix by Eric Dumazet replaces both kfree() calls with kfree_rcu(), delaying memory release past the RCU grace period.

Kernels from 4.4 onwards on unmaintained branches are also affected. IPv6 only affected via the migration path (separate fix pending).

Lab: Attack surface verification
I set up a TCP listener on 192.0.2.10:8080 (RFC 5737, all traffic stays on loopback) and crafted a SYN with an IP Record Route option from 192.0.2.11. If the kernel processes the option and stores it, the SYN-ACK carries the RR option — proof that the code path vulnerable to the race is reachable.

import socket, struct, secrets
SRC = '192.0.2.11'
DST = '192.0.2.10'
DPORT = 8080

# Build IP Record Route option: kind=7, len=39, ptr=4, 36 zero bytes
rr_opt = struct.pack('!BB', 7, 39) + struct.pack('!B', 4) + b'\x00' * 36

# IP header with ihl=15 (60 bytes): 20 base + 40 options
ip  = struct.pack('!BB...', 0x40 | 15, ...) + socket.inet_aton(SRC) + socket.inet_aton(DST)
tcp = struct.pack('!HH...', sport, DPORT, seq, 0, 5<<4, 0x02, 65535, 0, 0)
pkt = ip + rr_opt + tcp

sock = socket.socket(AF_INET, SOCK_RAW, IPPROTO_TCP)
sock.setsockopt(IPPROTO_IP, IP_HDRINCL, 1)
sock.sendto(pkt, (DST, 0))

raw, _ = sock.recvfrom(4096)
# IP hdrlen = (raw[0] & 0x0f) * 4 = 60
print('IP options:', raw[20:60].hex())

import socket, struct, secrets
SRC = '192.0.2.11'
DST = '192.0.2.10'
DPORT = 8080

# Build IP Record Route option: kind=7, len=39, ptr=4, 36 zero bytes
rr_opt = struct.pack('!BB', 7, 39) + struct.pack('!B', 4) + b'\x00' * 36

# IP header with ihl=15 (60 bytes): 20 base + 40 options
ip  = struct.pack('!BB...', 0x40 | 15, ...) + socket.inet_aton(SRC) + socket.inet_aton(DST)
tcp = struct.pack('!HH...', sport, DPORT, seq, 0, 5<<4, 0x02, 65535, 0, 0)
pkt = ip + rr_opt + tcp

sock = socket.socket(AF_INET, SOCK_RAW, IPPROTO_TCP)
sock.setsockopt(IPPROTO_IP, IP_HDRINCL, 1)
sock.sendto(pkt, (DST, 0))

raw, _ = sock.recvfrom(4096)
# IP hdrlen = (raw[0] & 0x0f) * 4 = 60
print('IP options:', raw[20:60].hex())

Real output from the lab: the SYN-ACK carries the RR option with the listener’s and source addresses recorded. This confirms that the kernel’s request socket stores and reflects IP options — the same data path the race condition attacks.

Detection
The preconditions (SYN with IPv4 options) can be caught with a tcpdump filter that detects IP header length > 5:

tcpdump -i eth0 'ip[0:1] & 0x0f > 5 and tcp[tcpflags] & tcp-syn == 2'

tcpdump -i eth0 'ip[0:1] & 0x0f > 5 and tcp[tcpflags] & tcp-syn == 2'

An nftables prerouting rule drops these packets before the TCP stack can process the options:

nft add table ip cve_2026_98432
nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'
nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop

nft add table ip cve_2026_98432
nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'
nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop

Mitigation
Temporary protection: disable MPTCP and request socket migration, then apply the nft rule above.

sysctl -w net.mptcp.enabled=0
sysctl -w net.ipv4.tcp_migrate_req=0

sysctl -w net.mptcp.enabled=0
sysctl -w net.ipv4.tcp_migrate_req=0

The only complete fix is upgrading to a patched kernel version. My lab kernel (Ubuntu 7.0.0-38-generic) already includes the fix — confirmed by grepping the source tree:

# grep net/ipv4/af_inet.c
165: kfree_rcu(rcu_dereference_protected(inet->inet_opt, 1), rcu);

# grep net/ipv4/af_inet.c
165: kfree_rcu(rcu_dereference_protected(inet->inet_opt, 1), rcu);

This is a serious remote kernel UAF that has been fixed with two trivial lines. Anthropic’s exploit (not public) reportedly chains it with MPTCP for KASLR bypass and root RCE. Patch your fleet if you run downstream of 4.4 — this is one of the easiest remote kernel exploits to check for.

Related reading: Setup WireGuard VPN · PwnEscape kernel UAF