CVE-2026-98432是Linux内核的IPv4 TCP握手路径中的一个无使用后。 当两个处理器对相关请求和子套接字采取行动时，缺陷就出现了，而两者仍然可以引用相同的IP选项对象。 一个路径可能立即释放该对象，而另一个仅作为区域协调单位读者保护的路径则继续使用。 结果是通过网络流量可以达到的代码中一个固态内核指针。
简洁的描述听起来像是熟悉的内核竞赛，但公开证据需要仔细解释。 CVE唱片搭载CVSS 3.1分9.8分，代表着一个网络可接触，未经认证的最坏病例，具有高度的保密性，完整性和可用性影响。 Red Hat的产品分析给出了较低的5.9分，因为它将开采视为一种困难的种族，并更保守地评估其支持的产品的实际后果。 另外，Anthropic的边疆红队报告说，在受控实验室有一个多路径TCP的监听器，对Linux服务器实施有效的远程根码执行链。 这一结果严重证明了在特定布局下可加以利用。 并不是每个未标注的Linux服务器，每个普通的TCP收听器，或每个发行架构都能以同样的方式受损的证据。
捍卫者应将这些言论视为补充。 上游记录确定了一个危险的内存-寿命错误及其理论上的最大影响。 分配分数说明销售商发运的代码、配置、缓解和预期开采条件。 一项研究展示了具体途径，即通过特定目标。 不应放弃其中任何一项，也不应超出其范围。
实际反应是直接的：识别可达到的Linux TCP服务，确定哪些供应商内核实际运行，安装供应商提供的固定建筑，重新启动其中，保留运行内核包含校正的证据。 暴露MPTCP听众的主持人应当立即受到关注，因为公共研究特别证实了这种环境。 互联网上网网关，负载平衡器，Kubernetes节点，VPN端点，反向代理，以及使用Linux网络的电器，即使它们没有故意启用MPTCP，也值得快速清点。
CVE-2026-98432证实情况
权威技术描述来自Linux内核CVE过程和上游补丁。 问题涉及与TCP请求套接字有关的IPv4选项数据的所有权和再生问题。 在TCP握手的服务器一侧，内核创建轻量级请求套接字，以表示尚未成为完整子套接字的连接。 当握手进展时，tcp v4 syn recv sock( ) 将请求的 ireq opt 指针作为 inet opt 传输到新子套接字。 它不重复对象。
同时，不同的CPU可以处理与同一请求相关的再发送SYN. 第二个路径可以通过 tcp check req () 发送另一个 SYN-ACK。 tcp v4 send synack () 和 inet csk route req () 等函数在一个区域协调单位读侧关键部分中读取请求的IP选项。 后期帮助，包括 ip building and send pkt () 和 ip options building ()，从选项对象中调试字段。 Debian安全追踪器复制上游解释，并将问题映射到固定的Debian内核包。
一生不匹配是核心问题。 读取器的行为就像区域协调单位保护对象，但销毁器以普通 kfree () 释放对象。 普通 kfree () 将分配用于再利用，而无需等待现有的区域协调单位阅读器完成。 如果子套接字在重传-SYN路径仍然使用选项时被销毁，第二个CPU可以继续读取不再属于该对象的内存。 主要的上游固定装置用相关破坏器的kfree rcu()代替立即释放，将开垦推迟到区域协调单位宽限期届满后进行。
脆弱性还有一个相关的移民申请案例。 如果启用net.ipv4.tcp migrate req=1，或者如果一个BPF SK REUSEPORT SELECT OR MIGRATE程序控制请求迁移，内核可能会克隆一个请求套接字。 旧请求及其克隆可以暂时共享相同的选项对象。 一个持有旧请求引用的CPU在克隆解脱时仍然可以使用对象。 因此，内核描述既改变inet sock destruction()，也改变tcp v4 reqsk destructionor()，以使用区域协调单位-意识回收。
第一期是IPv4 child-socket路径所特有的，因为对应的IPv6功能重复了选项，而不是转移同一个指针。 上游文本还有涉及 ipv6 opt 当 CALIPSO 存在时的 IPv6 请求-迁移的指出和该条件单独处理的称。 这一区分很重要：“IPv6不受影响”的说法过于宽泛，而主要IPv4所有权转让错误不适用于普通IPv6儿童创建路径的说法是准确的。
该补丁作为e3f33b0a1d89的承诺在上游合并，题为“ipv4：在区域协调单位宽限期后的自由inet opt和ireq opt”。 Ubuntu CVE页面识别了相同的介绍，并修正了许多Ubuntu内核口味的独立承诺和跟踪。 这是有用的证据，证明通用内核版本检查不能取代发行特定状态。
未证实的事实
这里引用的权威性来源没有证实公共互联网上的广泛利用。 Anthropic确定，其研究者可以将瑕疵转化为远程根指令执行，用MPTCP的监听器对受控目标执行。 这比仅是空难的证据更有力，应影响紧迫性。 它仍然无法提供对脆弱MPTCP服务的普遍程度、普遍的成功率，或证明同一开发链在内核建设、CPU架构、分配器、硬化剖面和网络路径方面没有变化。
公共材料也不能证明任何大量SYN再传播都是剥削。 重新传输的SYN包是自然发生的，因为包丢失，路由不对称，服务超载，客户端重试行为，以及中间箱。 对种族的利用可能会产生不寻常的模式，但这些模式需要与脆弱的宿主、相关选择、内核症状和时机的关联。 网络警报可以优先调查；它不能证明内核内部发生了无使用后事件。
没有单一的上游版本字符串可以准确标注每个供应商内核。 企业发行通常在保留更古老的基版的同时修复后港安全。 云供应商和电器供应商可自行运送内核建筑。 与上游发布列表进行比较的扫描仪可产生假阳性和假阴性。 可辩驳的结论来自供应商咨询，包换日志，构建元数据，VEX语句，或直接确认相关固定承诺被回传。
最后，解除MPTCP功能并不能移除基础IPv4寿命错误。 它移除了公共研究链中使用的确切的听器配置，并且在MPTCP不必要的地方可以有意义地减少即时曝光。 上游技术描述涵盖普通IPv4 TCP请求和儿童套接字路径以及请求迁移。 补丁部署仍然是持久的纠正。
脆弱TCP路径如何运作
一个TCP服务器通常接收一个SYN，用SYN-ACK回复，并等待最终的ACK. 内核避免在第一个包中分配一个完整的连接套接字，因为否则攻击者可以廉价地耗尽资源。 相反，它创造了一个紧凑的请求套接字，存储足够状态来验证和完成握手。 当ACK到达并且连接被接受时，内核会创建一个完整的子套接字，并将所选状态移动或复制进去。
IPv4选项使过渡复杂化。 IP选项可以携带影响路由或包处理的元数据。 内核分析收到的信息，并存储一个内部代表，用于日后的响应构建。 在受影响的路径中，请求套接字的 ireq opt 指针成为孩子套接字的 inet opt 指针。 转移可以避免复制，但意味着一个分配的寿命跨越两个套接字对象之间的边界。
在握手状态完全解决之前，同一连接的Tuple的第二个SYN可以到达。 再传播是TCP的正常部分。 内核可以处理在另一个CPU上的SYN，并利用原来的请求套接字构建一个SYN-ACK. 由于Linux网络高度平行，孩子套接字可以在另一个CPU仍在构建回复时向拆解方向前进。 请求路径使用一个区域协调单位的读取锁，表示其读取的数据必须保持有效，直到读侧关键部分结束。
旧的破坏者行为违反了这一期望。 子套接字没有包含 SOCK RCU FREE 行为会推迟其全部释放，而 inet sock destruction () 直接释放 inet opt。 第二个CPU可以保留指针，并读取已经返回分配器的内存中的optlen. 后期分配可以将不相关的数据放置在该地址，在读取之间改变值，或让后续代码在受攻击者影响的内容上运行。
免费的bug是危险的，因为即时症状取决于什么可以取代自由分配。 过时的访问可能读取旧字节，看起来无害。 它可能遇到中毒或未放大的记忆和坠毁。 它可能读取一个新的内核对象并披露数据。 有了对分配模式和时间的充分控制，研究者可能会把过时的参考变成更强大的读、写或控制流原始。 因此，脆弱性类别支持的结果从断断续续的握手失败到拒绝服务到代码执行，但必须对特定目标表明具体结果。
请求-迁移变体通过不同的地形学遵循相同的寿命原则。 再使用port允许多个套接字共享一个监听端口，BPF可以参与选择一个目标。 当一个听众更改状态时，请求迁移可能会移动等待连接。 内核克隆请求状态，创建一个窗口，其中两个请求对象提及相同的选项分配。 清除一个对象中的指针不会保护已经存在引用的CPU. 如果另一个对象的破坏器立即释放共享分配，则该读取器会变得呆滞。
该补丁并不试图串行一个全球锁背后的每个操作。 这将损害热网路径的伸缩性。 相反，它使直接利用与读者已经使用的同步模型保持一致。 这正是Read-Copy Update设计用来解决问题的一类问题。
区域协调股为何改变安全界限
Read-Copy Update允许读者以非常低的间接费用获取共享数据，而作者则发布替换并推迟释放旧版本。 阅读器进入区域协调单位读侧批判部分，获得指针，使用对象，退出。 作者可以将对象从数据结构中移除，因此新读者不再找到，但必须等待宽限期后才能恢复内存。 一个宽限期保证所有可能已经看到老指针的读者都完成了。
Linux 内核区域协调股的文件描述了基本的拆迁和回收拆分。 清除变化可达到性。 复垦还库至分所。 合并这些操作是无使用后错误的常见来源。 区域协调单位锁定不会对任意对象进行引用计算，也不会使直接kfree()安全。 相应的写入器必须使用一个区域协调单位-意识机制，例如 call rcu()或kfree rcu()。
在CVE-2026-98432中，读作pat
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
CVE-2026-98432 is a use-after-free in the Linux kernel’s IPv4 TCP handshake path. The flaw appears when two processors act on related request and child sockets while both can still reference the same IP options object. One path may free that object immediately while another path, protected only as an RCU reader, continues to use it. The result is a stale kernel pointer in code reachable through network traffic.
The concise description sounds like a familiar kernel race, but the public evidence demands careful interpretation. The CVE record carries a CVSS 3.1 score of 9.8, representing a network-reachable, unauthenticated worst case with high confidentiality, integrity, and availability impact. Red Hat’s product analysis assigns a lower 5.9 score because it treats exploitation as a difficult race and assesses the practical consequence in its supported products more conservatively. Separately, Anthropic’s Frontier Red Team reported a working remote root code-execution chain against a Linux server with a Multipath TCP listener in a controlled lab. That result is serious evidence of exploitability under a specific configuration. It is not evidence that every unpatched Linux server, every ordinary TCP listener, or every distribution build can be compromised in the same way.
Defenders should treat those statements as complementary. The upstream record identifies a dangerous memory-lifetime error and its theoretical maximum impact. A distribution score describes the vendor’s shipped code, configuration, mitigations, and expected exploit conditions. A research exploit demonstrates one concrete path through a particular target. None of the three should be discarded, and none should be stretched beyond its scope.
The practical response is direct: identify reachable Linux TCP services, determine which vendor kernel is actually running, install the vendor-provided fixed build, reboot into it, and retain evidence that the running kernel contains the correction. Hosts that expose MPTCP listeners deserve immediate attention because the public research specifically validated that environment. Internet-facing gateways, load balancers, Kubernetes nodes, VPN endpoints, reverse proxies, and appliances that use Linux networking also deserve a fast inventory even if they do not intentionally enable MPTCP.
What is confirmed about CVE-2026-98432
The authoritative technical description comes from the Linux kernel CVE process and the upstream patch. The issue involves ownership and reclamation of IPv4 option data associated with a TCP request socket. During the server side of a TCP handshake, the kernel creates a lightweight request socket to represent a connection that has not yet become a full child socket. When the handshake progresses, tcp_v4_syn_recv_sock() transfers the request’s ireq_opt pointer to the new child socket as inet_opt. It does not duplicate the object.
At the same time, a different CPU can process a retransmitted SYN associated with the same request. That second path can send another SYN-ACK through tcp_check_req(). Functions such as tcp_v4_send_synack() and inet_csk_route_req() read the request’s IP options inside an RCU read-side critical section. Later helpers, including ip_build_and_send_pkt() and ip_options_build(), dereference fields from the options object. The Debian security tracker reproduces the upstream explanation and maps the issue to fixed Debian kernel packages.
The lifetime mismatch is the core problem. The reader behaves as though RCU protects the object, but the destructor frees it with ordinary kfree(). Ordinary kfree() makes the allocation available for reuse without waiting for existing RCU readers to finish. If the child socket is destroyed while a retransmitted-SYN path still uses the options, the second CPU can continue reading memory that no longer belongs to that object. The primary upstream fix replaces immediate freeing with kfree_rcu() in the relevant destructors, delaying reclamation until an RCU grace period has elapsed.
The vulnerability also has a related request-migration case. If net.ipv4.tcp_migrate_req=1 is enabled, or if a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program controls request migration, the kernel may clone a request socket. The old request and its clone can temporarily share the same options object. A CPU holding a reference to the old request can still use the object while the clone is freed. The kernel description therefore changes both inet_sock_destruct() and tcp_v4_reqsk_destructor() to use RCU-aware reclamation.
The first issue is specific to the IPv4 child-socket path because the corresponding IPv6 function duplicates options instead of transferring the same pointer. The upstream text also notes an IPv6 request-migration concern involving ipv6_opt when CALIPSO is present and says that condition is handled separately. That distinction matters: a statement that “IPv6 is unaffected” is too broad, while a statement that the main IPv4 ownership-transfer bug does not apply to the ordinary IPv6 child creation path is accurate.
The patch was merged upstream as commit e3f33b0a1d89, titled “ipv4: free inet_opt and ireq_opt after an RCU grace period.” The Ubuntu CVE page identifies the same introduction and fix commits and tracks many Ubuntu kernel flavors independently. This is useful evidence that a generic kernel version check cannot replace distribution-specific status.
Facts that are not established
No authoritative source cited here establishes widespread exploitation across the public internet. Anthropic established that its researchers could turn the flaw into remote root command execution against a controlled target with an MPTCP listener. That is stronger than a crash-only proof and should influence urgency. It still does not provide a measured prevalence of vulnerable MPTCP services, a universal success rate, or proof that the same exploit chain works unchanged across kernel builds, CPU architectures, allocators, hardening profiles, and network paths.
The public material also does not justify assuming that any high volume of SYN retransmissions is exploitation. Retransmitted SYN packets occur naturally because of packet loss, asymmetric routing, overloaded services, client retry behavior, and middleboxes. Exploitation of a race may generate unusual patterns, but those patterns need correlation with a vulnerable host, relevant options, kernel symptoms, and timing. A network alert can prioritize investigation; it cannot prove a use-after-free occurred inside the kernel.
There is no single upstream version string that accurately labels every vendor kernel. Enterprise distributions routinely backport security fixes while retaining an older-looking base version. Cloud providers and appliance vendors may ship their own kernel builds. A scanner that compares only uname -r against an upstream release list can produce both false positives and false negatives. The defensible conclusion comes from a vendor advisory, package changelog, build metadata, VEX statement, or direct confirmation that the relevant fix commit was backported.
Finally, disabling MPTCP does not remove the underlying IPv4 lifetime bug. It removes the exact listener configuration used in the public research chain and can meaningfully reduce immediate exposure where MPTCP is unnecessary. The upstream technical description covers the ordinary IPv4 TCP request and child socket paths as well as request migration. Patch deployment remains the durable correction.
How the vulnerable TCP path works
A TCP server normally receives a SYN, replies with SYN-ACK, and waits for the final ACK. The kernel avoids allocating a complete connected socket at the first packet because an attacker could otherwise exhaust resources cheaply. Instead, it creates a compact request socket that stores enough state to validate and complete the handshake. When the ACK arrives and the connection is accepted, the kernel creates a full child socket and moves or copies selected state into it.
IPv4 options complicate that transition. IP options can carry metadata that influences routing or packet processing. The kernel parses the incoming information and stores an internal representation for later response construction. In the affected path, the request socket’s ireq_opt pointer becomes the child socket’s inet_opt pointer. The transfer avoids a copy, but it means the lifetime of one allocation crosses the boundary between two socket objects.
A second SYN for the same connection tuple can arrive before the handshake state has completely settled. Retransmission is a normal part of TCP. The kernel may process that SYN on another CPU and build a SYN-ACK using the original request socket. Since Linux networking is highly parallel, the child socket can progress toward teardown while the other CPU is still constructing the reply. The request path takes an RCU read lock, indicating that the data it reads must remain valid until the read-side critical section ends.
The old destructor behavior violated that expectation. The child socket did not carry the SOCK_RCU_FREE behavior that would defer its entire release, and inet_sock_destruct() freed inet_opt directly. The second CPU could retain the pointer and read optlen from memory that had already returned to the allocator. A later allocation could place unrelated data at that address, changing the value between reads or letting subsequent code operate on attacker-influenced contents.
Use-after-free bugs are dangerous because the immediate symptom depends on what replaces the freed allocation. The stale access may read the old bytes and appear harmless. It may encounter poisoned or unmapped memory and crash. It may read a new kernel object and disclose data. With sufficient control over allocation patterns and timing, a researcher may turn the stale reference into a more powerful read, write, or control-flow primitive. The vulnerability class therefore supports outcomes ranging from intermittent handshake failure through denial of service to code execution, but a specific outcome must be demonstrated for a specific target.
The request-migration variant follows the same lifetime principle through a different topology. Reuseport allows multiple sockets to share a listening port, and BPF can participate in choosing a target. Request migration may move pending connections when a listener changes state. The kernel clones request state, creating a window in which two request objects refer to the same options allocation. Clearing the pointer in one object does not protect a CPU that already holds a reference to it. If the other object’s destructor immediately frees the shared allocation, that reader becomes stale.
The patch does not attempt to serialize every operation behind one global lock. That would harm scalability in a hot network path. It instead aligns reclamation with the synchronization model that readers already use. This is precisely the kind of problem Read-Copy Update is designed to solve.
Why RCU changes the safety boundary
Read-Copy Update lets readers access shared data with very low overhead while writers publish replacements and defer freeing old versions. A reader enters an RCU read-side critical section, obtains a pointer, uses the object, and exits. A writer can remove the object from the data structure so new readers no longer find it, but it must wait for a grace period before reclaiming memory. A grace period ensures that all readers that could have seen the old pointer have finished.
The Linux kernel’s RCU documentation describes the essential removal-and-reclamation split. Removal changes reachability. Reclamation returns storage to the allocator. Conflating those operations is a common source of use-after-free errors. An RCU lock does not place a reference count on an arbitrary object and does not make direct kfree() safe. The corresponding writer must use an RCU-aware mechanism such as call_rcu() or kfree_rcu().
In CVE-2026-98432, the read pat
Auto-fetched and translated by AI Atlas. All rights belong to the original author.