# CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period

> CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period. CVSS 9.8 (CVSS 3.1), named in 4 status incident(s).

Canonical: https://rewindex.com/cve/CVE-2026-98432
Last updated: 2026-11-03T07:20:59Z

- Published: 2026-10-15 12:08 UTC · Updated: 2026-11-03 07:20 UTC · Assigner: Linux
- CVSS: 9.8 (CVSS 3.1) · Severity: Critical · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS: 0.76%, 55th percentile (scored 2026-11-03)
- CISA KEV: no

## Description

In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet\_opt and ireq\_opt after an RCU grace period tcp\_v4\_syn\_recv\_sock() transfers ownership of ireq-\>ireq\_opt to the child socket (newinet-\>inet\_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp\_check\_req(). tcp\_v4\_send\_synack() and inet\_csk\_route\_req() read ireq-\>ireq\_opt under rcu\_read\_lock() only, and ip\_build\_and\_send\_pkt() and ip\_options\_build() then read opt-\>optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet\_csk\_reqsk\_queue\_drop() calls timer\_delete\_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn\_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCK\_RCU\_FREE, and inet\_sock\_destruct() frees inet\_opt with a plain kfree(), leading to a use-after-free in ip\_options\_build(). A similar issue exists with request socket migration (net.ipv4.tcp\_migrate\_req=1, or a BPF\_SK\_REUSEPORT\_SELECT\_OR\_MIGRATE program). reqsk\_timer\_handler() clones the request socket with inet\_reqsk\_clone(), so that the old request socket and its clone share the same ireq\_opt, then reqsk\_migrate\_reset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcp\_v4\_syn\_recv\_sock()) when the clone is freed, and tcp\_v4\_reqsk\_destructor() also uses a plain kfree(). Readers already use RCU, and other paths replacing inet\_opt (do\_ip\_setsockopt(), cipso\_v4\_sock\_setattr()...) already use kfree\_rcu(). Use kfree\_rcu() in inet\_sock\_destruct() and tcp\_v4\_reqsk\_destructor() as well. IPv6 is not affected by the first issue, because tcp\_v6\_syn\_recv\_sock() duplicates the options. tcp\_v6\_reqsk\_destructor() has the same migration issue with ipv6\_opt, which is only set by CALIPSO. This will be addressed in a separate patch.

## Affected vendors and products

- Linux: Linux

## Tracked companies

- [Amazon Web Services](https://rewindex.com/company/aws.md)

## Status incidents that name it

- 2026-10-30 18:10 UTC [Linode (Akamai): Customer Security Advisory: CVE-2026-98432](https://rewindex.com/company/linode-akamai/incidents/nt58zhx3pmgm.md) (names this CVE): “Customer Security Advisory: CVE-2026-98432 While we continue to deploy kernel patches across our infrastructure, we have also deployed network rules that drop…”
- 2026-10-30 18:03 UTC [Akamai: Customer Security Advisory: CVE-2026-98432](https://rewindex.com/company/akamai/incidents/c8n6l6p08zcf.md) (names this CVE): “Customer Security Advisory: CVE-2026-98432 We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community:…”
- 2026-10-30 13:40 UTC [Northflank: Security incident](https://rewindex.com/company/northflank/incidents/cmvv0rn5a092f14rutwccodpp.md) (says not affected, matched “unaffected” elsewhere in the notice): “…control plane. Customers on forward-deployed or dedicated control planes are unaffected. Separately, we have patched CVE-2026-98432 across our fleet, including BYOC clusters where we have an active integration. If your BYOC cluster is no longer…”
- 2026-10-29 16:07 UTC [Redpanda: CVE-2026-98432 Investigation](https://rewindex.com/company/redpanda/incidents/01M646NEJXTMERQM6T0DJNQ3J1.md) (names this CVE): “CVE-2026-98432 Investigation Please see our Technical Service Bulletin for further information, and future updates.…”

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-98432)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-98432)
- [https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568](https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568)
- [https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936](https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936)
- [https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a](https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a)
- [https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036](https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036)
- [https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5](https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5)
- [https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2](https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2)
- [https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6](https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6)
- [https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b](https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-98432 · Markdown: https://rewindex.com/cve/CVE-2026-98432.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-98432 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-03T23:49:57.283Z