Overview
Recently, NSFOCUS CERT monitored that Linux released a security update to fix the Linux Kernel IPv4 TCP use-after-free vulnerability (CVE-2026-98432). Due to a race condition issue in the Linux kernel IPv4 network subsystem when concurrently handling TCP connection requests or socket migration, an unauthenticated attacker can trigger a use-after-free by sending specially crafted TCP packets. This can result in kernel information disclosure, memory corruption, or denial of service, and under specific conditions, achieve remote code execution. The CVSS score is 9.8. Currently, vulnerability details and PoC have been publicly disclosed; relevant users are advised to take protective measures as soon as possible.
The Linux kernel is the core component of the Linux operating system, responsible for key functions such as process management, memory management, device drivers, file systems, and network protocol stacks. It is widely deployed in servers, desktop systems, and embedded devices.
Reference Link: https://www.openwall.com/lists/oss-security/2026/10/30/1
Scope of Impact
Affected versions
- 4.4 <= Linux Kernel
- Linux Kernel 5.10.x < 5.10.272
- Linux Kernel 5.15.x < 5.15.223
- Linux Kernel 6.1.x < 6.1.190
- Linux Kernel 6.6.x < 6.6.159
- Linux Kernel 6.12.x < 6.12.113
- Linux Kernel 6.18.x < 6.18.56
- Linux Kernel 7.2.x < 7.2.10
- Linux Kernel 7.3-rc < 7.3-rc7
Note: End-of-life branches such as 4.4/4.9/4.14/4.19/5.4 rely on distributions or commercial support to backport patches.
Unaffected versions
- Linux Kernel < 4.4
- Linux Kernel 5.10.x >= 5.10.272
- Linux Kernel 5.15.x >= 5.15.223
- Linux Kernel 6.1.x >= 6.1.190
- Linux Kernel 6.6.x >= 6.6.159
- Linux Kernel 6.12.x >= 6.12.113
- Linux Kernel 6.18.x >= 6.18.56
- Linux Kernel 7.2.x >= 7.2.10
- Linux Kernel 7.3-rc >= 7.3-rc7
- Linux Kernel >= 7.3
Detection
Manual Detection
Linux system users can determine whether the current system is within the affected range by checking the kernel version. The command to view operating system version information is as follows:
| cat /proc/version |
Use the following command to check if MPTCP is enabled:
| sysctl net.mptcp.enabled |
Mitigation
Official upgrade
The vendor has released new versions and security patches to fix this vulnerability. Affected users are advised to update as soon as possible for protection.
Download links:
https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b
Other protective measures
If relevant users are temporarily unable to perform upgrades, the following mitigations can be used without disrupting business operations (does not replace patches):
1. Disable MPTCP and request socket migration, and remove BPF migration programs of type sk_reuseport, thereby reducing the risk of publicly known exploitation paths:
sysctl -w net.mptcp.enabled=0
sysctl -w net.ipv4.tcpmigratereq=0
2. Use firewalls to filter IPv4 SYN packets carrying options (requires business impact evaluation).
3. Apply access control to non-essential exposed TCP services.
Statement
This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.
About NSFOCUS
NSFOCUS, a pioneering leader in cybersecurity, is dedicated to safeguarding telecommunications, Internet service providers, hosting providers, and enterprises from sophisticated cyberattacks.
Founded in 2000, NSFOCUS operates globally with over 3000 employees at two headquarters in Beijing, China, and Santa Clara, CA, USA, and over 50 offices worldwide. It has a proven track record of protecting over 25% of the Fortune Global 500 companies, including four of the five largest banks and six of the world’s top ten telecommunications companies.
Leveraging technical prowess and innovation, NSFOCUS delivers a comprehensive suite of security solutions, including the Intelligent Security Operations Platform (ISOP) for modern SOC, DDoS Protection, Continuous Threat Exposure Management (CTEM) Service and Web Application and API Protection (WAAP). All the solutions and services are augmented by the Security Large Language Model (SecLLM), ML, patented algorithms and other cutting-edge research achievements developed by NSFOCUS.
