DEVOURED
TCP Use-After-Free: CVE-2026-98432/CVSS 9.8
CVE-2026-98432 is a critical use-after-free vulnerability in the Linux TCP handshake that allows remote attackers to potentially execute arbitrary code.
What: The bug exists in the IPv4 TCP handshake logic where socket options were freed prematurely while still in use by other CPU threads. It affects kernels from 4.4 and was fixed on October 15 in upstream stable releases.
Why it matters: This vulnerability is particularly dangerous because it is reachable during the initial TCP handshake, before any application logic or authentication occurs.
Takeaway: Immediately check your distribution's status; if a fixed kernel is available, update and reboot all Linux hosts, including Kubernetes nodes, that accept IPv4 TCP connections.
Deep dive
- Vulnerability involves a use-after-free race condition in the IPv4 TCP handshake.
- Affects Linux kernels 4.4 through the versions released in mid-October 2026.
- Exploits can be delivered by remote, unauthenticated peers.
- Anthropic reported that a PoC exploit exists and can run as root, specifically targeting servers with multipath TCP (MPTCP) listeners.
- Go 1.24+ programs may enable MPTCP by default on some Linux kernels, increasing exposure.
- Mitigation via nftables or iptables rules can drop packets with IPv4 options, but patching is the only permanent solution.
Decoder
- Use-after-free (UAF): A memory vulnerability where a program continues to use a pointer after the memory it points to has been freed, often allowing attackers to corrupt memory or gain control.
- Multipath TCP (MPTCP): A TCP extension that allows a single connection to use multiple network paths simultaneously for better throughput and reliability.
Original article
Full article content is not available for inline reading.
Explore all 69 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi