CVE-2026-98432: Linux Kernel IPv4 TCP Use-After-Free (CVSS 9.8) Enables Lab Remote Root

CVE-2026-98432 is a race-condition use-after-free (CWE-416) in the Linux kernel IPv4 TCP connection establishment path. The kernel CNA assigned a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The flaw allows a remote attacker who can reach a listening TCP socket to trigger concurrent processing of a retransmitted SYN while a child socket is being torn down, resulting in a use-after-free read (and potentially further memory corruption) inside ip_options_build().

CVE-2026-98432 at a Glance

Technical Root Cause

tcp_v4_syn_recv_sock() transfers ownership of the request socket's IP options pointer (ireq->ireq_opt) to the newly created child socket (newinet->inet_opt) by simple pointer assignment. It does not copy the structure and does not clear the original pointer.

Because request sockets have been installed into the established-hash table since the 2015-era commit noted above, they are processed without holding the listener lock. A second CPU can therefore concurrently handle a retransmitted SYN for the same request socket:

• tcp_check_req() → tcp_v4_send_synack() / inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only.
• Meanwhile the child socket can be destroyed. TCP child sockets do not carry SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree().

The concurrent reader reaches ip_options_build(), which dereferences opt->optlen twice. This creates a classic time-of-check/time-of-use window on freed memory. A related race exists on the request-socket migration path when net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is attached.

The fix replaces the immediate kfree() with kfree_rcu() in both inet_sock_destruct() and tcp_v4_reqsk_destructor(), ensuring the options structure is not reclaimed until all RCU readers have finished.

Anthropic Lab Remote Root Chain

On 27 October 2026 Anthropic's Frontier Red Team published research stating that an unreleased Claude model produced a working zero-click remote root exploit for CVE-2026-98432 against Linux servers that have a multipath TCP (MPTCP) listener. The CVE record itself describes the ordinary IPv4 TCP handshake path and does not mention MPTCP; the multipath linkage comes from Anthropic's post.

The demonstrated chain has two stages:

• Repeated winning of the race so that an attacker-controlled length field causes the kernel to over-read adjacent slab data and return a kernel pointer in a SYN-ACK IP options field, defeating KASLR (~48 minutes in the proof-of-concept).
• Use of the same UAF to overflow a buffer, overwrite a callback pointer with the address of a payload previously staged via an ordinary protocol feature, then invoke that callback to execute an arbitrary shell command as root (~5 additional minutes).

A failed race simply aborts the handshake without crashing the system, allowing indefinite retries. Anthropic reports the exploit was built in a lab environment and is not known to be used in attacks. The vulnerability was already patched upstream and backported to all maintained stable branches at the time of the publication.

Affected and Fixed Versions

The flaw is present from commit 079096f103fa until the respective stable fixes. Upstream and stable fixed releases include:

Distribution status varies. Debian has shipped fixed packages (bookworm 6.1.190-1, trixie 6.12.113-1). Ubuntu, Red Hat, and others were still in progress or deferred as of late October 2026. Operators must consult their distribution advisories for exact package versions; running uname -r after reboot is the definitive check.

Mitigation and Operational Guidance

Apply the vendor-supplied kernel update that contains the kfree_rcu() change and reboot so the new code is active. Prioritize internet-facing systems that accept TCP connections from untrusted networks.

Additional steps:

• Inventory hosts running MPTCP listeners (sysctl net.mptcp.enabled and ss -Mltn). While the underlying bug exists on ordinary IPv4 TCP, Anthropic's chain specifically required an MPTCP listener.
• Setting net.ipv4.tcp_migrate_req=0 removes one of the secondary race paths but does not eliminate the primary handshake race.
• Monitor for unusual volumes of retransmitted SYNs or anomalous IP options in handshake traffic if deep packet inspection is available; no public detection rules were widely available at the time of writing.

# Check whether MPTCP is enabled
sysctl net.mptcp.enabled

# List MPTCP listeners
ss -Mltn

# Disable the secondary request-socket migration race path
sysctl -w net.ipv4.tcp_migrate_req=0

No public proof-of-concept code has been observed, and the race window makes reliable exploitation non-trivial without careful timing and heap grooming. Nevertheless, the combination of network reachability, no authentication requirement, and a demonstrated lab path to root justifies rapid patching of exposed systems.

MITRE ATT&CK Mapping

Sources

• CVE Record CVE-2026-98432 (kernel.org CNA)
• Anthropic, "Discovering and exploiting vulnerabilities in critical, real-world software with Claude" (27 October 2026)
• Linux kernel stable commits fixing "ipv4: free inet_opt and ireq_opt after an RCU grace period" (e.g., e3f33b0a1d89 and backports)