CVE-2026-98432

CVE-2026-98432 concerns TCP and IPv4 option memory in the Linux kernel. A child socket can own the same option data that another CPU is still reading while it builds a SYNACK. Freeing the child can leave that reader with a stale pointer.

The Linux CNA describes a network peer reaching this path before application authentication. Its CVSS explanation identifies possible kernel memory disclosure, memory corruption, and crashes. The published score describes the flaw's potential impact; it does not prove exploitation in the wild.

A second case involves request-socket migration. Disabling net.ipv4.tcp_migrate_req alone is not a complete fix because the first path does not need migration. The upstream change defers memory freeing until an RCU grace period has passed.

The patch says IPv6 is not affected by the first path because that path copies options. It separately notes a related CALIPSO migration issue for another patch. That distinction must not become a claim that every IPv6 path is safe.

The upstream fix changes inet_sock_destruct() and tcp_v4_reqsk_destructor(). The CVE record names net/ipv4/af_inet.c and net/ipv4/tcp_ipv4.c as affected files. Do not infer host safety from the application version alone; the relevant code runs in the host kernel.

The Linux CNA lists branch-specific fixed versions 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. Read each against its own branch rather than using one number as a universal threshold.

At the October 29, 2026 check, Ubuntu's generic linux source-package rows for 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS remained vulnerable with fixes in progress. The listed work targets were 7.3.0-10.10, 7.0.0-43.43, 6.8.0-149.149, and 5.15.0-203.213, respectively. Those are not released-fix claims.

The same source package was marked vulnerable on Ubuntu 20.04, 18.04, and 16.04. Cloud, hardware-enablement, OEM, and real-time kernels have their own rows. Check the exact package and release before deciding its status.

Debian's tracker separately lists linux 6.1.190-1 fixed for bookworm security and 6.12.113-1 fixed for trixie security. Those distribution revisions do not certify an Ubuntu package.

For the current Ubuntu matrix and host checks, use our Ubuntu kernel status and triage report. Our vulnerability management glossary explains how to keep package evidence with the risk record. The patch management entry covers rollout and verification.

This CVE was absent from the fetched CISA KEV catalog dated October 28, checked October 29. Exploitation status remains unknown for this profile; KEV absence is not proof that attacks cannot occur.