{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/suse-linux-enterprise-server/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-98432"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Linux kernel (\u003e= 4.4)","Ubuntu","Red Hat Enterprise Linux","Amazon Linux","Oracle Linux","SUSE Linux Enterprise Server","Debian"],"_cs_severities":["high"],"_cs_tags":["vulnerability","linux","kernel"],"_cs_type":"threat","_cs_vendors":["Canonical","Red Hat","Amazon","Oracle","SUSE","Debian"],"content_html":"\u003cp\u003eCVE-2026-98432 is a use-after-free vulnerability in the Linux kernel's IPv4 TCP connection handling code, introduced in kernel version 4.4. A race condition occurs during the handshake process when IP options are processed; if a socket is destroyed while another CPU is processing IP options for a resent connection request, the kernel accesses freed memory. Anthropic demonstrated a proof-of-concept exploit path that uses this race condition to leak kernel memory (bypassing KASLR) and eventually achieve arbitrary code execution as root. As of October 29, 2026, no in-the-wild exploitation has been observed. Fixes are available for some distributions, while others (notably Ubuntu and RHEL) are still developing or testing patches.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker sends a TCP connection request with specific IP options (Record Route or Timestamp).\u003c/li\u003e\n\u003cli\u003eAttacker resends the request to trigger the race condition during the TCP handshake.\u003c/li\u003e\n\u003cli\u003eKernel prematurely frees memory associated with pending IP options while a second CPU attempts to read them.\u003c/li\u003e\n\u003cli\u003eAttacker forces the kernel to return the freed memory to the attacker, leaking kernel addresses.\u003c/li\u003e\n\u003cli\u003eAttacker utilizes leaked addresses to bypass KASLR.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the race condition again to overwrite a callback pointer in kernel memory.\u003c/li\u003e\n\u003cli\u003eKernel executes the attacker-controlled payload during pointer invocation.\u003c/li\u003e\n\u003cli\u003eAttacker gains root command execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for potential remote unauthenticated kernel memory corruption, system crashes, or arbitrary code execution with root privileges. Success depends on the attacker winning a race condition, which may require multiple connection attempts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all Linux-based servers to identify kernels running versions affected by CVE-2026-98432.\u003c/li\u003e\n\u003cli\u003eApply vendor-specific kernel updates as soon as they become available for your distribution.\u003c/li\u003e\n\u003cli\u003eFor custom kernel builds, update to patched versions: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, or 7.3.\u003c/li\u003e\n\u003cli\u003eMonitor for unusual kernel crashes (dmesg, /var/log/kern.log) that may indicate failed exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T17:30:03Z","date_published":"2026-10-29T17:30:03Z","id":"https://feed.craftedsignal.io/briefs/2026-10-linux-kernel-tcp-race/","summary":"A race condition in the Linux kernel IPv4 TCP handshake allows remote unauthenticated attackers to trigger a use-after-free, potentially leading to kernel memory corruption or root code execution.","title":"Linux Kernel: TCP IPv4 race condition memory corruption (CVE-2026-98432)","url":"https://feed.craftedsignal.io/briefs/2026-10-linux-kernel-tcp-race/"}],"language":"en","title":"CraftedSignal Threat Feed - SUSE Linux Enterprise Server","version":"https://jsonfeed.org/version/1.1"}