Red Hat ships fixes for 9.8-rated Linux TCP use-after-free; Ubuntu's sit in testing

Fixed kernels for a use-after-free in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9 and 10. Ubuntu's fixes for its three newest long-term-support releases are still in its opt-in testing channel, and there's no date for a regular update.

The bug is tracked as CVE-2026-98432, with a CVSS base score of 9.8. The upstream description says it can be reached by a remote, unauthenticated attacker.

The mechanism, per the kernel write-up: tcp_v4_syn_recv_sock() hands ownership of ireq->ireq_opt to the child socket without copying it. Another CPU can process a retransmitted SYN for the same request socket and send a SYNACK, reading those options under rcu_read_lock() only. Since commit 079096f103fa, request sockets are processed without the listener lock, so nothing stops the child from being freed while the SYNACK is still being built. TCP child sockets don't have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(). That's the use-after-free in ip_options_build().

A second path involves request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program), where a clone and the original share the same ireq_opt. The fix is to use kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor(), matching what other paths that replace inet_opt already do.

IPv6 isn't affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options. The description says tcp_v6_reqsk_destructor() has the same migration problem with ipv6_opt, which only CALIPSO sets, and that it will be handled in a separate patch.

The source doesn't say whether anyone has exploited this in the wild, and no write-up of an attack has been published. We'd treat the Ubuntu testing-channel status as the thing to check first if you run those releases: testing kernels are opt-in, so a host that hasn't pulled them is still on the old code.

CVE references

CVE-2026-98432