Cloudanix VulnDB

CVE-2026-98432

None

CVSS

—

EPSS

0.2%

Published

Oct 15, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of network connection options can let one part of the system delete data that another part is still using, which may crash the machine or allow attackers to gain elevated access.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in ip_options_build() when inet_opt/ireq_opt is freed via kfree() in inet_sock_destruct() or tcp_v4_reqsk_destructor() while other CPUs may still read it under RCU during SYNACK processing or request socket migration.

Why it matters to the business

Linux kernel crashes or memory corruption on systems accepting TCP connections, potentially enabling local privilege escalation or remote denial of service with high operational disruption for servers and network appliances.

How an attack unfolds

An attacker triggers concurrent retransmitted SYN packets or request socket migration (tcp_migrate_req) so that one path frees the options structure while another path (tcp_check_req, tcp_v4_send_synack, ip_options_build) still holds a reference and reads optlen without proper synchronization.

How to fix it

Apply kernel patches that replace kfree with kfree_rcu in inet_sock_destruct() and tcp_v4_reqsk_destructor; rebuild and reboot to a fixed kernel version; disable tcp_migrate_req if migration is not required.

How to confirm the fix worked

Confirm the presence of kfree_rcu calls in the two destructors via source inspection or kernel symbol checks; verify no plain kfree remains on inet_opt paths; test with concurrent SYN/retransmit workloads.

Typical attack path

  1. Send initial SYN to create a request socket with ireq_opt
  2. Trigger retransmitted SYN or migration path while child socket is created
  3. Force free of inet_opt via socket destruction on one CPU
  4. Continue SYNACK construction or option processing on another CPU to trigger UAF read in ip_options_build

How to detect it

Inspect kernel logs for oops/panic traces mentioning ip_options_build, inet_opt, or ireq_opt; correlate with high volumes of retransmitted SYN packets or tcp_migrate_req activity; examine crash dumps for use-after-free patterns in IPv4 TCP paths.

What your security team should do

  • Prioritize kernel updates on all internet-facing and multi-tenant Linux systems within the next maintenance window
  • Monitor EPSS and KEV status for any rise in exploit maturity
  • Temporarily disable net.ipv4.tcp_migrate_req where feasible until patched
  • Review downstream distributions for backported fixes

The record

In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build(). A similar issue exists with request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler() clones the request socket with inet_reqsk_clone(), so that the old request socket and its clone share the same ireq_opt, then reqsk_migrate_reset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcp_v4_syn_recv_sock()) when the clone is freed, and tcp_v4_reqsk_destructor() also uses a plain kfree(). Readers already use RCU, and other paths replacing inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor() as well. IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options. tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is only set by CALIPSO. This will be addressed in a separate patch.

Affected packages

Ecosystem Package Introduced Fixed