{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/linux-kernel--4.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-98432"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Linux kernel (\u003e= 4.4)","Ubuntu","Red Hat Enterprise Linux","Amazon Linux","Oracle Linux","SUSE Linux Enterprise Server","Debian"],"_cs_severities":["high"],"_cs_tags":["vulnerability","linux","kernel"],"_cs_type":"threat","_cs_vendors":["Canonical","Red Hat","Amazon","Oracle","SUSE","Debian"],"content_html":"\u003cp\u003eCVE-2026-98432 is a use-after-free vulnerability in the Linux kernel's IPv4 TCP connection handling code, introduced in kernel version 4.4. A race condition occurs during the handshake process when IP options are processed; if a socket is destroyed while another CPU is processing IP options for a resent connection request, the kernel accesses freed memory. Anthropic demonstrated a proof-of-concept exploit path that uses this race condition to leak kernel memory (bypassing KASLR) and eventually achieve arbitrary code execution as root. As of October 29, 2026, no in-the-wild exploitation has been observed. Fixes are available for some distributions, while others (notably Ubuntu and RHEL) are still developing or testing patches.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sends a TCP connection request with specific IP options (Record Route or Timestamp).\u003c/li\u003e\n\u003cli\u003eAttacker resends the request to trigger the race condition during the TCP handshake.\u003c/li\u003e\n\u003cli\u003eKernel prematurely frees memory associated with pending IP options while a second CPU attempts to read them.\u003c/li\u003e\n\u003cli\u003eAttacker forces the kernel to return the freed memory to the attacker, leaking kernel addresses.\u003c/li\u003e\n\u003cli\u003eAttacker utilizes leaked addresses to bypass KASLR.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the race condition again to overwrite a callback pointer in kernel memory.\u003c/li\u003e\n\u003cli\u003eKernel executes the attacker-controlled payload during pointer invocation.\u003c/li\u003e\n\u003cli\u003eAttacker gains root command execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for potential remote unauthenticated kernel memory corruption, system crashes, or arbitrary code execution with root privileges. Success depends on the attacker winning a race condition, which may require multiple connection attempts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all Linux-based servers to identify kernels running versions affected by CVE-2026-98432.\u003c/li\u003e\n\u003cli\u003eApply vendor-specific kernel updates as soon as they become available for your distribution.\u003c/li\u003e\n\u003cli\u003eFor custom kernel builds, update to patched versions: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, or 7.3.\u003c/li\u003e\n\u003cli\u003eMonitor for unusual kernel crashes (dmesg, /var/log/kern.log) that may indicate failed exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T17:30:03Z","date_published":"2026-10-29T17:30:03Z","id":"https://feed.craftedsignal.io/briefs/2026-10-linux-kernel-tcp-race/","summary":"A race condition in the Linux kernel IPv4 TCP handshake allows remote unauthenticated attackers to trigger a use-after-free, potentially leading to kernel memory corruption or root code execution.","title":"Linux Kernel: TCP IPv4 race condition memory corruption (CVE-2026-98432)","url":"https://feed.craftedsignal.io/briefs/2026-10-linux-kernel-tcp-race/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:6.7:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2024-0582"},{"cvss":9.8,"id":"CVE-2026-98432"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Linux Kernel (\u003c 6.6.5, 6.7)","Linux Kernel (\u003e= 4.4)"],"_cs_severities":["critical"],"_cs_tags":["privilege-escalation","linux","kernel","io_uring","vulnerability","remote-code-execution","cve-2026-98432"],"_cs_type":"advisory","_cs_vendors":["Linux"],"content_html":"\u003cp\u003eA proof-of-concept exploit for CVE-2024-0582 has been published, targeting a use-after-free vulnerability within the Linux kernel io_uring subsystem during buffer ring unregistration. The exploit utilizes a \u0026quot;Dirty Cred\u0026quot; approach to corrupt kernel structures, specifically modifying the f_mode flags of file descriptors to grant write access to protected files, including /etc/passwd. Successful exploitation allows a local attacker to escalate privileges to root by injecting a backdoor entry into /etc/passwd.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eSet CPU affinity and raise file descriptor limits to ensure exploit stability.\u003c/li\u003e\n\u003cli\u003eInitialize an io_uring instance and register a buffer ring in kernel memory.\u003c/li\u003e\n\u003cli\u003eUnregister the buffer ring to trigger the use-after-free vulnerability.\u003c/li\u003e\n\u003cli\u003ePerform a file descriptor spray to target the /etc/passwd file descriptor.\u003c/li\u003e\n\u003cli\u003eCorrupt the f_mode flags of the target file descriptor to make /etc/passwd writable.\u003c/li\u003e\n\u003cli\u003eAppend a custom root user backdoor entry to /etc/passwd.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants a local user full root privileges. The exploit requires local access and can be used to bypass system integrity by modifying sensitive configuration files.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit kernel versions across the environment to identify systems running Linux Kernel versions \u0026lt; 6.6.5 or 6.7.\u003c/li\u003e\n\u003cli\u003ePrioritize patching affected Linux kernels to the latest available stable release.\u003c/li\u003e\n\u003cli\u003eDeploy monitoring for unauthorized or anomalous modifications to /etc/passwd.\u003c/li\u003e\n\u003cli\u003eRestrict the use of io_uring for non-privileged users if the workload allows, as it is a common vector for local privilege escalation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T15:52:00Z","date_published":"2026-10-23T19:48:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-linux-kernel-lpe/","summary":"CVE-2024-0582 is a privilege escalation vulnerability in the Linux kernel io_uring subsystem that enables unauthorized write access to /etc/passwd via a Dirty Cred technique.","title":"Linux Kernel: io_uring privilege escalation (CVE-2024-0582)","url":"https://feed.craftedsignal.io/briefs/2026-10-linux-kernel-lpe/"}],"language":"en","title":"CraftedSignal Threat Feed - Linux Kernel (\u003e= 4.4)","version":"https://jsonfeed.org/version/1.1"}