Linux kernel: remote use-after-free in IPv4 TCP via IP options (CVE-2026-98432), no Ubuntu fix yet
Published 29/10/2026 15:25 · Updated 29/10/2026 17:33 (revision 2)
Timeline
3 events over 26 min
- 29/10/2026 14:59ConfirmedBSI CERT-Bund (WID)+3 min
- 29/10/2026 15:03Unconfirmedmanual+22 min
- 29/10/2026 15:25Published on WatchtowerPro CISO
In short
A flaw in the Linux kernel's IPv4 TCP code (CVE-2026-98432, CVSS 9.8) lets an attacker with no account crash a system, read kernel memory or corrupt it by sending crafted connection requests to any listening TCP port. The upstream kernel is fixed; Ubuntu has not released a fixed kernel yet (29/10/2026). No exploitation has been reported. Until the fixed kernel is installed and the system rebooted, drop incoming TCP packets that carry IP options at the firewall.
How bad is it
Anyone who can reach a listening TCP port can try it, without logging in: a crash at least; memory disclosure or corruption is possible but not demonstrated (Red Hat: Moderate; kernel team: CVSS 9.8).
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
CVSS 3.1 from NVD, from the vendor, read 29/10/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Take it offline
Type: memory corruption.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Linux kernels from 4.4 up to the fixed stable releases, on any system with a listening IPv4 TCP port.
- Ubuntu: every supported release from 16.04 LTS to 26.10 is vulnerable (14.04 is not affected); fixes are in progress for 24.04 LTS (6.8.0-149.149), 22.04 LTS (5.15.0-203.213) and 26.04 LTS (7.0.0-43.43).
Fixed in
- Upstream stable kernels: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113 and 6.18.56.
- Ubuntu: no fixed kernel released yet (29/10/2026).
What to do now
- Drop incoming IPv4 TCP packets that carry IP options at each Linux server's firewall - legitimate TCP never uses them. With nftables: a prerouting rule `ip hdrlength > 5 meta l4proto tcp drop` in a table of its own, loaded from its own file by its own systemd unit - not through the stock nftables service, whose configuration flushes every other rule (ufw, fail2ban, Docker) when it starts.
- Watch for your distribution's fixed kernel (Ubuntu: linux 6.8.0-149 or later for 24.04 LTS) and install it as soon as it is released.
- Plan the reboot: the fix only takes effect when the system runs the new kernel.
- Keep the firewall rule until every server runs a fixed kernel.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 3 open questions, followed up as sources answer, all 3 sources with their dates and every revision. And technology matching: which of your systems run Linux kernel, at which version, fixed or not - and what each one needs.
Main sources
Ubuntu: CVE-2026-98432 Vendor · CVE-2026-98432 (Linux kernel CVE team) Vendor · Linux stable fix: ipv4: free inet_opt and ireq_opt after an RCU grace period Vendor