Linux Kernel: TCP IPv4 race condition memory corruption (CVE-2026-98432)

CVE-2026-98432 is a use-after-free vulnerability in the Linux kernel's IPv4 TCP connection handling code, introduced in kernel version 4.4. A race condition occurs during the handshake process when IP options are processed; if a socket is destroyed while another CPU is processing IP options for a resent connection request, the kernel accesses freed memory. Anthropic demonstrated a proof-of-concept exploit path that uses this race condition to leak kernel memory (bypassing KASLR) and eventually achieve arbitrary code execution as root. As of October 29, 2026, no in-the-wild exploitation has been observed. Fixes are available for some distributions, while others (notably Ubuntu and RHEL) are still developing or testing patches.

Attack Chain

1. Attacker sends a TCP connection request with specific IP options (Record Route or Timestamp).
2. Attacker resends the request to trigger the race condition during the TCP handshake.
3. Kernel prematurely frees memory associated with pending IP options while a second CPU attempts to read them.
4. Attacker forces the kernel to return the freed memory to the attacker, leaking kernel addresses.
5. Attacker utilizes leaked addresses to bypass KASLR.
6. Attacker triggers the race condition again to overwrite a callback pointer in kernel memory.
7. Kernel executes the attacker-controlled payload during pointer invocation.
8. Attacker gains root command execution.

Impact

The vulnerability allows for potential remote unauthenticated kernel memory corruption, system crashes, or arbitrary code execution with root privileges. Success depends on the attacker winning a race condition, which may require multiple connection attempts.

Recommendation

• Inventory all Linux-based servers to identify kernels running versions affected by CVE-2026-98432.
• Apply vendor-specific kernel updates as soon as they become available for your distribution.
• For custom kernel builds, update to patched versions: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, or 7.3.
• Monitor for unusual kernel crashes (dmesg, /var/log/kern.log) that may indicate failed exploitation attempts.