CVE-2026-98432 - Vulnerability Details

- ipv4: free inet_opt and ireq_opt after an RCU grace period

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: free inet_opt and ireq_opt after an RCU grace period

tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the
child socket (newinet->inet_opt) without copying it.

Another cpu can concurrently process a retransmitted SYN for the same
request socket, and send a SYNACK from tcp_check_req().
tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt
under rcu_read_lock() only, and ip_build_and_send_pkt() and
ip_options_build() then read opt->optlen twice.

Note that the SYNACK timer itself is not an issue: it holds a
reference on its request socket, and inet_csk_reqsk_queue_drop()
calls timer_delete_sync() before the child can be freed.

Since commit 079096f103fa ("tcp/dccp: install syn_recv requests
into ehash table"), request sockets are processed without holding
the listener lock, so nothing prevents the child socket from being
freed while the SYNACK is still being built. TCP child sockets do
not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt
with a plain kfree(), leading to a use-after-free in
ip_options_build().

A similar issue exists with request socket migration
(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE
program). reqsk_timer_handler() clones the request socket with
inet_reqsk_clone(), so that the old request socket and its clone
share the same ireq_opt, then reqsk_migrate_reset() clears the
pointer in the old one. Another cpu holding a reference on the old
request socket can still be using these options (sending a SYNACK,
or creating a child in tcp_v4_syn_recv_sock()) when the clone is
freed, and tcp_v4_reqsk_destructor() also uses a plain kfree().

Readers already use RCU, and other paths replacing inet_opt
(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use
kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and
tcp_v4_reqsk_destructor() as well.

IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()
duplicates the options. tcp_v6_reqsk_destructor() has the same
migration issue with ipv6_opt, which is only set by CALIPSO. This
will be addressed in a separate patch.

Published: 2026-10-15

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel causes the IPv4 TCP child socket to inherit the ireq_opt field from a request socket and then free it while still in use. The freed memory can be read again as the child socket is constructed, which leads to a use‑after‑free that can trigger a kernel crash or a denial of service. The vulnerability does not directly leak data.

Affected Systems

All Linux kernel builds that contain the old TCP IPv4 implementation prior to the fix are affected. No specific version list is supplied, so any kernel before the merge that introduced kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor() is at risk.

Risk and Exploitability

The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of widespread exploitation. The CVSS score of 9.8 indicates high severity. It is inferred that the attack vector is external—through network traffic, such as crafted TCP SYN packets—because the race condition occurs during concurrent SYN processing. An attacker would need to generate SYN traffic that triggers the race between the freeing of ireq_opt and its subsequent read, potentially causing a kernel crash or service disruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`079096f103faca2dd87342cca6f23d4b34da8871`	affected	< b3b027ef0cd322bfa839b9aaf5b27551eea54cf6
`079096f103faca2dd87342cca6f23d4b34da8871`	affected	< 95a8c8fa9f27dce64c40c41c062de7728bf34ab5
`079096f103faca2dd87342cca6f23d4b34da8871`	affected	< 89b5b1eb7d633c33832b7ff2c02e19a144705036
`079096f103faca2dd87342cca6f23d4b34da8871`	affected	< 742f73df544e03744f2981c467d6542fe8172a2a
`079096f103faca2dd87342cca6f23d4b34da8871`	affected	< 11a03ce3c4a62d84c10ccdfe47f8075006498568
`079096f103faca2dd87342cca6f23d4b34da8871`	affected	< a47406c769f72c070386985488f1c4d057df86b2
`079096f103faca2dd87342cca6f23d4b34da8871`	affected	< 26d4c36d318cffbbd160884a0e4cec0da4da4936
`079096f103faca2dd87342cca6f23d4b34da8871`	affected	< e3f33b0a1d89d738e2b913dab519226eaf76e15b

Linux

affected

Version	Status	Constraints
`4.4`	affected	—
`0`	unaffected	< 4.4
`5.10.272`	unaffected	≤ 5.10.*
`5.15.223`	unaffected	≤ 5.15.*
`6.1.190`	unaffected	≤ 6.1.*
`6.6.159`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[079096f103faca2dd87342cca6f23d4b34da8871,b3b027ef0cd322bfa839b9aaf5b27551eea54cf6)`	affected	code_commit	—
`[079096f103faca2dd87342cca6f23d4b34da8871,95a8c8fa9f27dce64c40c41c062de7728bf34ab5)`	affected	code_commit	—
`[079096f103faca2dd87342cca6f23d4b34da8871,89b5b1eb7d633c33832b7ff2c02e19a144705036)`	affected	code_commit	—
`[079096f103faca2dd87342cca6f23d4b34da8871,742f73df544e03744f2981c467d6542fe8172a2a)`	affected	code_commit	—
`[079096f103faca2dd87342cca6f23d4b34da8871,11a03ce3c4a62d84c10ccdfe47f8075006498568)`	affected	code_commit	—
`[079096f103faca2dd87342cca6f23d4b34da8871,a47406c769f72c070386985488f1c4d057df86b2)`	affected	code_commit	—
`[079096f103faca2dd87342cca6f23d4b34da8871,26d4c36d318cffbbd160884a0e4cec0da4da4936)`	affected	code_commit	—
`[079096f103faca2dd87342cca6f23d4b34da8871,e3f33b0a1d89d738e2b913dab519226eaf76e15b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.4`	affected	semver	—
`[0,4.4)`	unaffected	semver	—
`[5.10.272,5.10.*]`	unaffected	generic	—
`[5.15.223,5.15.*]`	unaffected	generic	—
`[6.1.190,6.1.*]`	unaffected	generic	—
`[6.6.159,6.6.*]`	unaffected	generic	—
`[6.12.113,6.12.*]`	unaffected	generic	—
`[6.18.56,6.18.*]`	unaffected	generic	—
`[7.2.10,7.2.*]`	unaffected	generic	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patch which replaces plain kfree() with kfree_rcu() for inet_opt and ireq_opt cleanup (e.g., kernel commits 079096f103fa and the associated merge).
Set the sysctl net.ipv4.tcp_migrate_req=0 or disable BPF_SK_REUSEPORT_SELECT_OR_MIGRATE to stop request‑socket migration paths that share ireq_opt with clones.
Apply the specific patch commit 079096f103fa directly if your distribution does not provide an updated kernel.

Generated by OpenCVE AI on October 24, 2026 at 15:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0076.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/10/30/1
http://www.openwall.com/lists/oss-security/2026/10/30/6
http://www.openwall.com/lists/oss-security/2026/10/31/5
http://www.openwall.com/lists/oss-security/2026/11/03/1
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox
https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568
https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936
https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a
https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036
https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5
https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2
https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6
https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b
https://nvd.nist.gov/vuln/detail/CVE-2026-98432
https://www.cve.org/CVERecord?id=CVE-2026-98432

History

Tue, 03 Nov 2026 07:30:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/11/03/1

Sat, 31 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/10/31/5

Fri, 30 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/10/30/6

Fri, 30 Oct 2026 02:30:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/10/30/1

Sat, 24 Oct 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 17 Oct 2026 03:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Sat, 17 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98432 https://www.cve.org/CVERecord?id=CVE-2026-98432
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 16 Oct 2026 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Thu, 15 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build(). A similar issue exists with request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler() clones the request socket with inet_reqsk_clone(), so that the old request socket and its clone share the same ireq_opt, then reqsk_migrate_reset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcp_v4_syn_recv_sock()) when the clone is freed, and tcp_v4_reqsk_destructor() also uses a plain kfree(). Readers already use RCU, and other paths replacing inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor() as well. IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options. tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is only set by CALIPSO. This will be addressed in a separate patch.
Title		ipv4: free inet_opt and ireq_opt after an RCU grace period
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568 https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936 https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036 https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5 https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2 https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6 https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-15T12:08:22.205Z

Updated: 2026-11-03T06:08:32.425Z

Reserved: 2026-09-25T10:25:14.348Z

Link: CVE-2026-98432

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-15T13:17:13.987

Modified: 2026-11-03T07:20:59.297

Link: CVE-2026-98432

Redhat

Severity : Moderate

Publid Date: 2026-10-15T00:00:00Z

Links: CVE-2026-98432 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-24T15:30:14Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object