Critical CVE-2026-98432 Use-After-Free Vulnerability Found in Linux Kernel
A critical Linux kernel use-after-free vulnerability in the IPv4 TCP handshake path allows for remote root command execution, requiring an urgent kernel update.
CVE-2026-98432 carries a CVSS 3.1 score of 9.8 in the Linux CNA record and is a use-after-free in the Linux kernel's IPv4 TCP handshake path. You need to install your vendor's fixed kernel, reboot into it, and keep evidence that the running kernel has the fix. Anthropic reported remote root command execution in a controlled lab against a server with a Multipath TCP listener. Hosts exposing MPTCP are the most urgent, but internet-facing gateways, load balancers, Kubernetes nodes, VPN endpoints, reverse proxies, and appliances built on Linux networking also need a fast inventory.
During the server side of a TCP handshake, tcp_v4_syn_recv_sock hands the request's ireq_opt pointer to the new child socket without copying the object. If a retransmitted SYN arrives on another CPU, tcp_check_req can send another SYN-ACK while readers concurrently access IP options inside an RCU read-side critical section, which results in a destructor freeing memory with ordinary kfree without waiting for RCU readers.
The upstream fix is commit e3f33b0a1d89, which switches relevant destructors to kfree_rcu so reclamation is delayed until readers finish. You should check vendor advisories, package changelogs, build metadata, VEX statements, or backport confirmations rather than relying on uname -r.