---
title: "CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period"
url: https://erroneo.us/security/cve/CVE-2026-98432/
description: "CVE-2026-98432 (Linux Linux): In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-10-15
date_modified: 2026-11-03
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-98432"
kev: false
cvss: 9.8
epss: 0.0076
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.8% , percentile 55: FIRST’s model estimates a 0.8% chance of exploitation activity in the next 30 days, higher than 55% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Editorial verdict: Patch this week. Linux IPv4 TCP Use-After-Free CVE-2026-98432: Remote RCE — A working, unpublished root exploit over plain TCP exists for servers with an MPTCP listener, which every Go 1.24+ server on Linux opens by default; boot a fixed kernel this week and prioritize internet-facing hosts.

## What it is

In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period tcpv4synrecvsock() transfers ownership of ireq->ireqopt to the child socket (newinet->inetopt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcpcheckreq(). tcpv4sendsynack() and inetcskroutereq() read ireq->ireqopt under rcureadlock() only, and ipbuildandsendpkt() and ipoptionsbuild() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inetcskreqskqueuedrop() calls timerdeletesync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install synrecv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCKRCUFREE, and inetsockdestruct() frees inetopt with a plain kfree(), leading to a use-after-free in ipoptionsbuild(). A similar issue exists with request socket migration (net.ipv4.tcpmigratereq=1, or a BPFSKREUSEPORTSELECTORMIGRATE program). reqsktimerhandler() clones the request socket with inetreqskclone(), so that the old request socket and its clone share the same ireqopt, then reqskmigratereset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcpv4synrecvsock()) when the clone is freed, and tcpv4reqskdestructor() also uses a plain kfree(). Readers already use RCU, and other paths replacing inetopt (doipsetsockopt(), cipsov4socksetattr()...) already use kfreercu(). Use kfreercu() in inetsockdestruct() and tcpv4reqskdestructor() as well. IPv6 is not affected by the first issue, because tcpv6synrecvsock() duplicates the options. tcpv6reqskdestructor() has the same migration issue with ipv6opt, which is only set by CALIPSO. This will be addressed in a separate patch.

## Affected products (CVE record)

- Linux Linux: 079096f103faca2dd87342cca6f23d4b34da8871 < b3b027ef0cd322bfa839b9aaf5b27551eea54cf6, 079096f103faca2dd87342cca6f23d4b34da8871 < 95a8c8fa9f27dce64c40c41c062de7728bf34ab5, 079096f103faca2dd87342cca6f23d4b34da8871 < 89b5b1eb7d633c33832b7ff2c02e19a144705036, 079096f103faca2dd87342cca6f23d4b34da8871 < 742f73df544e03744f2981c467d6542fe8172a2a, 079096f103faca2dd87342cca6f23d4b34da8871 < 11a03ce3c4a62d84c10ccdfe47f8075006498568, 079096f103faca2dd87342cca6f23d4b34da8871 < a47406c769f72c070386985488f1c4d057df86b2, 079096f103faca2dd87342cca6f23d4b34da8871 < 26d4c36d318cffbbd160884a0e4cec0da4da4936, 079096f103faca2dd87342cca6f23d4b34da8871 < e3f33b0a1d89d738e2b913dab519226eaf76e15b
- Linux Linux: 4.4

## Severity

- Linux CVSS 3.1: 9.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- FIRST EPSS (model of 2026-11-05): 0.76% probability of exploitation activity in the next 30 days; percentile 55.

## Sources

- [CVE.org record CVE-2026-98432](https://www.cve.org/CVERecord?id=CVE-2026-98432)
- [NVD entry CVE-2026-98432](https://nvd.nist.gov/vuln/detail/CVE-2026-98432)
- [git.kernel.org](https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6)
- [git.kernel.org](https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5)
- [git.kernel.org](https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036)
- [git.kernel.org](https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a)
- [git.kernel.org](https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568)
- [git.kernel.org](https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2)
- [git.kernel.org](https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936)
- [git.kernel.org](https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b)
- [openwall.com](http://www.openwall.com/lists/oss-security/2026/10/30/1)
- [openwall.com](http://www.openwall.com/lists/oss-security/2026/10/30/6)
- [openwall.com](http://www.openwall.com/lists/oss-security/2026/10/31/5)
- [openwall.com](http://www.openwall.com/lists/oss-security/2026/11/03/1)

---
Source page: https://erroneo.us/security/cve/CVE-2026-98432/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt