In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period…
CVE-2026-98432
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period tcpv4synrecvsock() transfers ownership of ireq->ireqopt to the child socket (newinet->inetopt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcpcheckreq(). tcpv4sendsynack() and inetcskroutereq() read ireq->ireqopt under rcureadlock() only, and ipbuildandsendpkt() and ipoptionsbuild() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inetcskreqskqueuedrop() calls timerdeletesync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install synrecv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCKRCUFREE, and inetsockdestruct() frees inetopt with a plain kfree(), leading to a use-after-free in ipoptionsbuild(). A similar issue exists with request socket migration (net.ipv4.tcpmigratereq=1, or a…
Proof-of-concept code is published
Public PoC
- Public PoCH1z3-br0/CVE-2026-984327 stars
- Public PoCtc4dy/CVE-2026-98432-PoC-Exploit6 stars
- Public PoCtyphoon1217/cve-2026-98432-mitigation5 stars
- Public PoCmahdi-salmanzade/CVE-2026-984324 stars
- Public PoCxen0bit/netprobe-cve-2026-984324 stars
- Public PoCAlucard0x1/cve-2026-984323 stars
- Public PoCbitwire-it/Probe-CVE-2026-984322 stars
- Public PoCQuaerendir/cve-2026-98432-audit1 stars
Signals come from Exploit-DB, Metasploit, Nuclei and published proof-of-concept repositories. Their absence means nothing was found, not that nothing exists.
Assessment
- CVSS
- 9.8 (v3.1)
- Severity
- Critical
- EPSS
- 0.45% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Public PoC
- Published
- 15 October 2026
- Last updated
- 31 October 2026
- Affected
- Linux
- Assigner
- Linux
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
At the source
References
- https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6
- https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5
- https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036
- https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a
- https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568
- https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2
- https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936
- https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-98432