news.volyx.in

TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 (atlasum.net)

751 points by oger · 6 days ago · 334 comments on HN

Article summary

A critical vulnerability, CVE-2026-98432, has been discovered in the Linux kernel's IPv4 TCP handshake, allowing remote, unauthenticated peers to exploit a use-after-free bug. The vulnerability affects Linux kernels from 4.4 onwards and has a CVSS score of 9.8. The bug can be exploited before any application sees the connection, and a working proof-of-concept exploit has been developed. Patches are available for some distributions, but others, such as Ubuntu and RHEL, have not yet released fixed kernels.

Main themes

  • Linux kernel vulnerability
  • TCP use-after-free bug
  • CVE-2026-98432
  • Multipath TCP
  • Kernel patching
  • Security mitigations

What commenters say

  • The vulnerability is particularly concerning because it can be exploited before any application sees the connection, making it a kernel-level issue rather than an application-level one.
  • Multipath TCP is not a requirement for exploitation, but it may make the vulnerability easier to exploit in certain cases.
  • Some commenters believe that dropping packets with IP options can help mitigate the vulnerability, but others argue that this is not a sufficient mitigation strategy.
  • The fact that some distributions, such as Ubuntu and RHEL, have not yet released fixed kernels is seen as a concern by some commenters, who argue that these distributions should prioritize releasing patches for critical vulnerabilities.
  • Others argue that the exploitability of the vulnerability over the internet is unlikely due to ISP routers dropping packets with IP options, but this claim is disputed by some who point out that many devices, such as Apple iPhones, support MPTCP and may be able to exploit the vulnerability.
  • There is a debate about the effectiveness of various mitigation strategies, including blocking multipath TCP and adding firewall rules to drop packets with IPv4 options.
  • Some commenters are concerned about the potential impact of the vulnerability on consumer-grade routers and other devices that may not receive timely patches or updates.