CVE-2026-98432: 9.8 CVE affecting all Ubuntu versions

What it is

CVE-2026-98432 is a use-after-free in the Linux kernel IPv4 TCP stack. Ubuntu published its entry on 15 October 2026 and updated it on 29 October 2026, with High priority, CVSS v3.1 9.8 and CVSS v4.0 8.3. The fix changes the free of inet_opt and ireq_opt to kfree_rcu(), so the memory is released only after an RCU grace period.

How it works

The page describes two races. Both end with ip_options_build() reading freed IP options.

1. Retransmitted SYN. tcp_v4_syn_recv_sock() hands ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another CPU can process a retransmitted SYN for the same request socket and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read the options under rcu_read_lock() only. ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Since commit 079096f103fa, request sockets are processed without the listener lock, so nothing stops the child from being freed mid-SYNACK. Child sockets lack SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with plain kfree().
2. Request socket migration. reqsk_timer_handler() clones the request socket with inet_reqsk_clone(), and the old socket and the clone share the same ireq_opt. reqsk_migrate_reset() clears the pointer only in the old one. Another CPU holding a reference to the old socket may still be sending a SYNACK or creating a child when the clone is freed. tcp_v4_reqsk_destructor() also uses plain kfree().

The patch switches inet_sock_destruct() and tcp_v4_reqsk_destructor() to kfree_rcu(). Other paths that replace inet_opt, such as do_ip_setsockopt() and cipso_v4_sock_setattr(), already used it.

Preconditions / Affected

• The first race needs a listening IPv4 TCP socket receiving a retransmitted SYN while the child socket is being freed.
• The migration race needs net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program.
• IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options.
• The SYNACK timer itself is not a problem. It holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed.
• The CVSS v4.0 vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N. It scores availability impact High and confidentiality and integrity Low, and marks attack requirements as Present. The v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

What to do

Install the Ubuntu kernel update that carries the fix. Ubuntu says it recommends not cherry-picking updates. The page text does not list per-release package status or fixed versions, so check the Ubuntu CVE page's status table before relying on the title's "all Ubuntu versions" claim. The page offers no workaround. Checking whether net.ipv4.tcp_migrate_req is enabled or a reuseport migration BPF program is loaded shows whether the second race is reachable, but it does not remove the first.

Caveats

• The IPv6 counterpart is not fixed here. tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is only set by CALIPSO. The page says a separate patch will address it.
• The page gives no exploitation reports and no proof of concept.