TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
- ID
- 41675
- Status
- summarized
- Published
- 01 Nov 2026, 3:16 AM
- Fetched
- 01 Nov 2026, 2:18 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf
- Source URL
- https://hnrss.org/best
Summary
- Score
- 8.0
- Created
- 01 Nov 2026, 2:19 PM
- Tags
- Audience
- developersvibe_coderssaas_startup_founders
What happened
CVE-2026-98432 is a CVSS 9.8 remote use-after-free in Linux’s IPv4 TCP handshake, affecting kernels from 4.4 and fixed upstream on Oct 15 in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. As of Oct 31, Ubuntu’s tracker still listed its kernels as vulnerable and Red Hat listed RHEL 8/9/10 as affected with no fix, while Debian, current SUSE Enterprise, Oracle UEK, and Amazon Linux had fixes. Anthropic says its Claude model wrote a working PoC that runs commands as root against Linux servers with a multipath TCP listener, and the Go Security Team says Go programs open those listeners by default.
Why it matters
Check your fleet for Ubuntu/RHEL kernels without a distro fix and for Go services that may have opened multipath TCP listeners by default; if you cannot patch yet, apply the interim rule to drop IPv4 TCP packets carrying options and disable MPTCP where unused, prioritizing hosts with MPTCP listeners.
Discussion angle
How would you detect and prioritize hosts with multipath TCP listeners—especially Go services—before Ubuntu/RHEL ship fixed kernels, and who owns emergency kernel reboots in your stack?