https://feed.craftedsignal.io/products/linux-kernel--4.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 17:30:03 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-linux-kernel-tcp-race/Thu, 29 Oct 2026 17:30:03 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-linux-kernel-tcp-race/A race condition in the Linux kernel IPv4 TCP handshake allows remote unauthenticated attackers to trigger a use-after-free, potentially leading to kernel memory corruption or root code execution.CVE-2026-98432 is a use-after-free vulnerability in the Linux kernel's IPv4 TCP connection handling code, introduced in kernel version 4.4. A race condition occurs during the handshake process when IP options are processed; if a socket is destroyed while another CPU is processing IP options for a resent connection request, the kernel accesses freed memory. Anthropic demonstrated a proof-of-concept exploit path that uses this race condition to leak kernel memory (bypassing KASLR) and eventually achieve arbitrary code execution as root. As of October 29, 2026, no in-the-wild exploitation has been observed. Fixes are available for some distributions, while others (notably Ubuntu and RHEL) are still developing or testing patches.

Attack Chain

1. Attacker sends a TCP connection request with specific IP options (Record Route or Timestamp).
2. Attacker resends the request to trigger the race condition during the TCP handshake.
3. Kernel prematurely frees memory associated with pending IP options while a second CPU attempts to read them.
4. Attacker forces the kernel to return the freed memory to the attacker, leaking kernel addresses.
5. Attacker utilizes leaked addresses to bypass KASLR.
6. Attacker triggers the race condition again to overwrite a callback pointer in kernel memory.
7. Kernel executes the attacker-controlled payload during pointer invocation.
8. Attacker gains root command execution.

Impact

The vulnerability allows for potential remote unauthenticated kernel memory corruption, system crashes, or arbitrary code execution with root privileges. Success depends on the attacker winning a race condition, which may require multiple connection attempts.

Recommendation

• Inventory all Linux-based servers to identify kernels running versions affected by CVE-2026-98432.
• Apply vendor-specific kernel updates as soon as they become available for your distribution.
• For custom kernel builds, update to patched versions: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, or 7.3.
• Monitor for unusual kernel crashes (dmesg, /var/log/kern.log) that may indicate failed exploitation attempts.

]]>highthreatvulnerabilitylinuxkernelhttps://feed.craftedsignal.io/briefs/2026-10-linux-kernel-lpe/Fri, 23 Oct 2026 19:48:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-linux-kernel-lpe/CVE-2024-0582 is a privilege escalation vulnerability in the Linux kernel io_uring subsystem that enables unauthorized write access to /etc/passwd via a Dirty Cred technique.A proof-of-concept exploit for CVE-2024-0582 has been published, targeting a use-after-free vulnerability within the Linux kernel io_uring subsystem during buffer ring unregistration. The exploit utilizes a "Dirty Cred" approach to corrupt kernel structures, specifically modifying the f_mode flags of file descriptors to grant write access to protected files, including /etc/passwd. Successful exploitation allows a local attacker to escalate privileges to root by injecting a backdoor entry into /etc/passwd.

Attack Chain

1. Set CPU affinity and raise file descriptor limits to ensure exploit stability.
2. Initialize an io_uring instance and register a buffer ring in kernel memory.
3. Unregister the buffer ring to trigger the use-after-free vulnerability.
4. Perform a file descriptor spray to target the /etc/passwd file descriptor.
5. Corrupt the f_mode flags of the target file descriptor to make /etc/passwd writable.
6. Append a custom root user backdoor entry to /etc/passwd.

Impact

Successful exploitation grants a local user full root privileges. The exploit requires local access and can be used to bypass system integrity by modifying sensitive configuration files.

Recommendation

• Audit kernel versions across the environment to identify systems running Linux Kernel versions < 6.6.5 or 6.7.
• Prioritize patching affected Linux kernels to the latest available stable release.
• Deploy monitoring for unauthorized or anomalous modifications to /etc/passwd.
• Restrict the use of io_uring for non-privileged users if the workload allows, as it is a common vector for local privilege escalation.

]]>criticaladvisoryprivilege-escalationlinuxkernelio_uringvulnerabilityremote-code-executioncve-2026-98432