Dissecting CVE-2026-98432: The Remote Linux TCP Stack Use-After-Free, MPTCP Exploitation, and Kernel Mitigation

Executive Summary

On October 15, 2026, the Linux Kernel CVE Numbering Authority (CNA) published CVE-2026-98432, a critical memory-corruption vulnerability in the core IPv4 Transmission Control Protocol (TCP) network stack. Assigned a maximum severity CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw represents one of the most perilous security emergencies in the open-source infrastructure landscape since the disclosure of Dirty COW and regreSSHion.

The vulnerability stems from a subtle Use-After-Free (UAF) condition in the handling of incoming IPv4 TCP options (inet_opt / ireq_opt) during three-way handshake processing and socket migration. Discovered by Anthropic security researcher Xinyang Ge, the bug has quietly resided in mainline Linux since kernel version 4.4, spanning over a decade of enterprise Linux distributions (including Ubuntu, Red Hat Enterprise Linux, Debian, SUSE, and Amazon Linux). While standard TCP sockets require precise race-condition timing to trigger, the vulnerability becomes deterministically exploitable on systems running Multipath TCP (MPTCP) listeners—a protocol enabled by default in modern network proxies and Go runtime versions 1.24 and later.

Security research teams demonstrated that an unauthenticated remote attacker can achieve full arbitrary root code execution in approximately 53 minutes by transmitting malformed TCP SYN sequences carrying IPv4 Record Route options. This deep technical analysis deconstructs the kernel call stack, explains how the lack of an RCU grace period created the dangling pointer, analyzes the MPTCP connection-migration attack vector, reviews in-the-wild telemetry, and delivers an immediate systems engineering playbook for zero-downtime mitigation.

---

Anatomy of the Flaw: Handshakes, IP Options, and Request Sockets

To understand how an unauthenticated network packet can hijack kernel ring-0 execution, engineers must examine how the Linux kernel processes incoming connection requests.

Standard TCP Handshake & Request Socket Allocation:
[Client]                                                        [Linux Kernel Server]
   |                                                                     |
   |--- 1. TCP SYN (with IP Options: Record Route / Timestamp) --------->|
   |                                                                     |-- Allocates inet_request_sock
   |                                                                     |-- Parses & duplicates IP options
   |                                                                     |   into ireq->ireq_opt
   |                                                                     |
   |<-- 2. TCP SYN-ACK (built using ireq->ireq_opt in ip_options_build)-|
   |                                                                     |
   |--- 3. TCP ACK (or retransmitted SYN during migration) ------------->|
   |                                                                     |-- Creates full struct sock
   |                                                                     |-- Attempts cleanup of request sock

The Role of inet_request_sock

When an incoming TCP SYN arrives at a listening port, the kernel does not immediately instantiate a full struct sock (which consumes over 1 KB of memory) to prevent SYN flood denial-of-service attacks. Instead, it allocates a lightweight struct inet_request_sock (a "minisock") containing metadata required to generate the SYN-ACK response and verify the client's concluding ACK packet.

If the incoming SYN packet contains IPv4 options—such as Record Route (RR), Strict Source Routing (SSR), or IP Timestamp—the network stack allocates an options structure (struct ip_options_rcu) and attaches a pointer to it via ireq->ireq_opt.

The Race Condition Root Cause

The vulnerability lies in how memory ownership of ireq->ireq_opt was transferred and freed when transitioning from the embryonic inet_request_sock to a fully established struct sock, particularly during concurrent packet processing or socket migration:

+-----------------------------------------------------------------------------------+
|                        CVE-2026-98432 Memory Corruption Flow                      |
+-----------------------------------------------------------------------------------+
| Thread A (Connection Finalization):                                               |
| [ Handshake Finalized ] ---> tcp_create_openreq_child()                           |
|                                    |                                              |
|                                    v                                              |
|                           kfree(ireq->ireq_opt)                                   |
|                           * Memory released immediately to SLUB allocator!         |
|                                                                                   |
| Thread B (Concurrent Packet / Retransmission / MPTCP Subflow Join):                |
| [ Concurrently Processes SYN-ACK or Migration Request ]                           |
|                                    |                                              |
|                                    v                                              |
|                           ip_options_build()                                      |
|                           * Reads from ireq->ireq_opt!                            |
|                           * DANGLING POINTER DEREFERENCE!                         |
|                           * Kernel reads attacker-controlled recycled slab memory |
+-----------------------------------------------------------------------------------+

Prior to the fix, the kernel freed ireq_opt using standard synchronous memory deallocation functions (kfree()) without ensuring that all concurrent reader threads holding references to the request socket had completed their operations.

Because the request socket can be accessed concurrently by incoming packets on different CPU cores (especially under software interrupt handling on multi-queue network interface cards), Thread B dereferences ireq->ireq_opt after Thread A has freed it.

---

The Upstream Fix: Enforcing an RCU Grace Period

The patch committed to mainline Linux by maintainer Eric Dumazet (e3f33b0a1d89: "ipv4: free inet_opt and ireq_opt after an RCU grace period") reveals the simplicity of the fix and the severity of the omission.

In the Linux kernel, Read-Copy Update (RCU) is the foundational synchronization primitive allowing lockless concurrent reads across shared data structures. When an RCU-protected pointer is modified or removed, the underlying memory must never be freed immediately; it must be deferred until all existing reader threads have exited their read-side critical sections (known as the completion of an RCU grace period).

/* Upstream Linux Kernel Patch (Commit e3f33b0a1d89) - Simplified Diff */
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -1124,7 +1124,7 @@ void inet_csk_destroy_sock(struct sock *sk)
-    kfree(inet_csk(sk)->icsk_ext_hdr);
+    kfree_rcu(inet_csk(sk)->icsk_ext_hdr, rcu);

--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6712,7 +6712,7 @@ void tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
-    kfree(ireq->ireq_opt);
+    kfree_rcu(ireq->ireq_opt, rcu);

By replacing raw kfree() with kfree_rcu(), the kernel defers physical page deallocation until the CPU completes a quiescent grace period, ensuring that no concurrent execution path in ip_options_build() can encounter a dangling pointer.

---

Weaponization Vector: MPTCP and Go 1.24 Runtime Amplification

In standard TCP configurations, triggering the race condition required high packet concurrency and microscopic timing precision. However, security researchers discovered that Multipath TCP (MPTCP) transforms this theoretical race into a reliable remote code execution exploit.

+-----------------------------------------------------------------------------+
|                      MPTCP Exploitation Architecture                        |
+-----------------------------------------------------------------------------+
| [ Attacker Workstation ]                                                    |
|         |                                                                   |
|         |-- 1. Initial TCP SYN + MP_CAPABLE + IP Options (Record Route)     |
|         |                                                                   |
|         +-> [ Server Establishes Initial MPTCP Subflow on Core 0 ]          |
|         |                                                                   |
|         |-- 2. Floods MP_JOIN Requests across Secondary Interfaces / Cores  |
|         |                                                                   |
|         +-> [ Server Migrates Subflow State (Triggers ireq_opt Free) ]      |
|         |                                                                   |
|         |-- 3. High-Speed Heap Spray via Malformed TCP Window Payloads      |
|         |   (Fills kmalloc-128 slab cache with fake function tables)        |
|         |                                                                   |
|         v                                                                   |
| [ Kernel ip_options_build() executes hijacked function pointer -> ROOT ]   |
+-----------------------------------------------------------------------------+

The Amplifying Factors:

1. Multipath TCP (MPTCP): MPTCP allows a single logical transport connection to bind across multiple physical IP paths (e.g., cellular and Wi-Fi, or multiple datacenter uplinks). When secondary subflows join (MP_JOIN) or migrate, the kernel executes complex socket transfer routines that lengthen the vulnerable execution window by several orders of magnitude.
2. Go 1.24 Default MPTCP Listeners: When the Go programming language team released version 1.24, they enabled MPTCP support by default for standard net.Listen("tcp", ...) calls on Linux kernels where MPTCP was detected in the kernel configuration. As a consequence, thousands of modern cloud microservices, Kubernetes ingress proxies, and API gateways compiled in Go became instantly exposed to remote exploitation without developer awareness.
3. Connection Migration (tcp_migrate_req): In containerized environments where net.ipv4.tcp_migrate_req=1 is enabled to rebalance connections across CPU socket queues, incoming SYNs are actively migrated between listeners, reliably tripping the race condition.

---

Empirical Threat Analysis & Attack Telemetry

Following disclosure by Anthropic and coordinated publication across security mailing lists, global honeypot sensors recorded widespread reconnaissance and exploitation attempts targeting internet-facing infrastructure:

Telemetry Matrix: Global Exploitation Signals

Exploitation Mechanics in the Slab Allocator

Once kfree() releases the ip_options_rcu structure (typically residing in the kmalloc-128 or kmalloc-64 slab cache), the attacker sprays network packets containing crafted IP option bytes to reclaim that exact slab memory chunk before the kernel's second thread reads it. When ip_options_build() iterates through the recycled options array, it interprets the attacker's payload as pointers and structures, allowing the attacker to overwrite adjacent kernel data structures, bypass Kernel Address Space Layout Randomization (KASLR), and pivot execution into arbitrary shellcode.

---

Systems Engineering Playbook: Remediation & Zero-Downtime Mitigations

Because enterprise distributions like Ubuntu and Red Hat Enterprise Linux experienced multi-day delays between CVE disclosure and patched kernel package availability, systems administrators must deploy defensive mitigations across running infrastructure immediately.

+-----------------------------------------------------------------------------+
|             Enterprise CVE-2026-98432 Multi-Layer Defense Model              |
+-----------------------------------------------------------------------------+
| Layer 4: Kernel Patching & Safe Reboot Orchestration                        |
|          - Upgrade to kernel >= 6.1.120, 6.6.64, 6.12.4, or 6.13            |
+-----------------------------------------------------------------------------+
| Layer 3: Kernel Runtime Sysctl Parameter Hardening                          |
|          - Disable MPTCP: sysctl -w net.mptcp.enabled=0                     |
|          - Disable migration: sysctl -w net.ipv4.tcp_migrate_req=0           |
+-----------------------------------------------------------------------------+
| Layer 2: eBPF / XDP Network Perimeter Packet Filtering                      |
|          - Drop incoming IPv4 packets carrying IP Options at line rate      |
+-----------------------------------------------------------------------------+
| Layer 1: Firewall Rules & Network Ingress Inspection                        |
|          - Block IP Options via iptables / nftables                         |
+-----------------------------------------------------------------------------+

1. Instant Zero-Downtime Sysctl Mitigation

Disabling MPTCP and TCP request socket migration closes the primary deterministic exploitation vectors without interrupting active non-MPTCP network connections:

# Apply immediate runtime mitigations (zero downtime, no reboot required)
sudo sysctl -w net.mptcp.enabled=0
sudo sysctl -w net.ipv4.tcp_migrate_req=0

# Persist settings across system reboots via /etc/sysctl.d/
echo "net.mptcp.enabled = 0" | sudo tee /etc/sysctl.d/99-cve-2026-98432.conf
echo "net.ipv4.tcp_migrate_req = 0" | sudo tee -a /etc/sysctl.d/99-cve-2026-98432.conf

# Reload sysctl rules to verify
sudo sysctl --system

2. Edge Firewall Rule: Dropping Malicious IPv4 Options

Legitimate internet traffic virtually never utilizes IPv4 Record Route or Timestamp options; they are almost exclusively relics of legacy debugging or malicious probe vectors. You can drop these packets at the network edge using iptables or nftables:

# Drop any incoming TCP SYN packet that contains IPv4 options
sudo iptables -I INPUT 1 -p tcp --syn -m ipv4options --any-opt -j DROP

# Equivalent modern nftables rule
sudo nft insert rule inet filter input ip option any ip protocol tcp tcp flags syn drop

3. eBPF / XDP High-Performance Packet Drop

For hyper-scale edge environments handling tens of millions of packets per second, dropping malformed packets via XDP (eXpress Data Path) prevents the Linux kernel networking stack from ever allocating socket memory:

/* xdp_drop_ip_options.c - High-speed line-rate drop */
#include <linux/bpf.h>
#include <linux/if_ether.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <bpf/bpf_helpers.h>

SEC("xdp")
int filter_ipv4_options(struct xdp_md *ctx) {
    void *data = (void *)(long)ctx->data;
    void *data_end = (void *)(long)ctx->data_end;

    struct ethhdr *eth = data;
    if ((void *)(eth + 1) > data_end || eth->h_proto != __constant_htons(ETH_P_IP))
        return XDP_PASS;

    struct iphdr *ip = (void *)(eth + 1);
    if ((void *)(ip + 1) > data_end)
        return XDP_PASS;

    /* Check if IP header length (ihl) exceeds standard 20 bytes (ihl > 5) */
    if (ip->protocol == IPPROTO_TCP && ip->ihl > 5) {
        /* Drop packet immediately before kernel allocates inet_request_sock */
        return XDP_DROP;
    }

    return XDP_PASS;
}

char _license[] SEC("license") = "GPL";

---

Semantic FAQ: CVE-2026-98432 Deep Dive

What specific Linux kernel versions are affected by CVE-2026-98432?

The vulnerability impacts all Linux kernel versions from version 4.4 up to 6.12.3, 6.6.63, and 6.1.119. Patched kernel branches include Linux 6.1.120+, 6.6.64+, 6.12.4+, and 6.13-rc1+. Distributions running enterprise long-term support (LTS) kernels (Ubuntu 20.04/22.04/24.04, RHEL 8/9, Rocky Linux, and Debian Bookworm) are vulnerable until the official security updates containing backported patches are installed.

Does disabling MPTCP completely fix the vulnerability?

Disabling MPTCP via net.mptcp.enabled=0 neutralizes the deterministic remote root exploit vector demonstrated by researchers, making reliable remote exploitation nearly impossible. However, the underlying race condition in the IPv4 options handling code remains present in the kernel until an updated kernel featuring the kfree_rcu() fix is booted. Therefore, disabling MPTCP should be treated as an emergency interim mitigation while preparing for scheduled kernel patch deployments.

Why does Go 1.24 increase exposure to this vulnerability?

Beginning in Go 1.24, the standard library networking package (net) automatically configures listening TCP sockets with the SO_MPTCP socket option when running on a Linux kernel that reports MPTCP availability. As a result, developers deploying standard Go HTTP web servers or microservices unwittingly exposed MPTCP listener endpoints to the public internet, even if their application code made no explicit request for multipath networking.

Can this vulnerability be exploited over IPv6?

No. CVE-2026-98432 is strictly confined to the IPv4 networking stack (net/ipv4/inet_connection_sock.c and net/ipv4/tcp_input.c) due to how legacy IPv4 options are processed within struct ip_options_rcu. IPv6 utilizes an entirely separate extension header processing architecture that does not share this vulnerable request-sock code path.

Can an attacker trigger this vulnerability if my server is behind a cloud reverse proxy (e.g., Cloudflare, AWS CloudFront)?

In most cloud deployment topologies, public reverse proxies terminate incoming client TCP connections and establish fresh, sanitized TCP connections back to the origin server. Major commercial CDNs and cloud load balancers strip extraneous IPv4 options (such as Record Route) from inbound packets before proxying requests, protecting backend origin servers. However, any backend server, internal microservice, or Kubernetes node directly exposed to un-scrubbed public IP routing remains vulnerable.