CVE-2026-98432 hits Linux IPv4 TCP kernel

Several vendors and distributions have released fixes for CVE-2026-98432, a use-after-free vulnerability in the Linux kernel that affects inbound IPv4 TCP connection handling. The advisories agree the bug can lead to kernel crashes, memory disclosure or memory corruption, and some describe a risk of remote code execution under certain conditions.

What did vendors report?

AlmaLinux, Red Hat, CloudLinux, AWS, Ubuntu, STACKIT, Akamai, Konfirmity, F5 and the University of Heidelberg Computing Center all published advisories on the same flaw. In those reports, the vulnerability is tied to the Linux kernel’s IPv4 TCP stack and to a memory release issue linked to the processing of incoming connections.

Red Hat classified it as critical and said a remote unauthenticated attacker could exploit a race condition during TCP request processing to trigger remote code execution. AWS, meanwhile, said that under specific conditions an unauthenticated remote party can send specially crafted IPv4 TCP packets with IP options to an exposed port, with possible outcomes including kernel crashes, memory disclosure or memory corruption.

CloudLinux described the bug as a use-after-free in the IPv4 TCP handshake code, tied to freeing memory without waiting for an RCU grace period. F5 detailed the upstream fix and explained that inet_opt and ireq_opt memory must be freed after that grace period, because tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket without copying it.

What technical scope was reported?

STACKIT said CVE-2026-98432 affects IPv4, not IPv6, and released fixed kernel versions for several branches. Its advisory lists 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3.10.

AlmaLinux also announced patched kernels for versions 8, 9 and 10. Ubuntu said the fixes were initially available in the proposed repository and recommended applying the relevant security updates. Konfirmity added that an attacker who can reach any listening TCP port can trigger the flaw before the application receives the connection, and pointed to container hosts and Kubernetes nodes as relevant environments.

Akamai described the issue as a remote use-after-free in the Linux kernel TCP stack and said a public exploit would allow an unauthenticated remote attacker to run commands as root on Linux servers with an MPTCP listener. That specific scope should be treated cautiously, because the available material does not provide independent corroboration.

What did the University of Heidelberg say?

The University of Heidelberg Computing Center said that, under certain conditions, CVE-2026-98432 can remotely crash the Linux kernel or, under certain conditions, enable remote code execution. That wording was presented as a conditional possibility, not as confirmation of observed exploitation.