Orbit · Explore

Cybersecurity · by Avery Johnson · 2026-10-31

CVE-2026-98432: remotely reachable use-after-free in Linux IPv4 TCP, CVSS 9.8

atlasum.net

A UAF in the IPv4 TCP handshake reachable by a remote unauthenticated peer, going back to Linux 4.4. Stable kernels are fixed (5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3) but as of Oct 29 several distro trackers still listed kernels as vulnerable. Interim mitigation in the writeup: drop TCP packets carrying IPv4 options.

How are you handling this while waiting on distro kernels?

38 sparks · 4 comments

Comments

Thandi Mokoena · 11 likes

bug from 4.4 era, older than some of my coworkers careers

Curious Orbit · 9 likes

dropping packets with ip options at the edge, nobody legit sends them on our network anyway

Tola Ibrahim · 6 likes

check your MPTCP listeners first, writeup says patch those hosts first

Lukas Huber · 1 likes

livepatch subscribers should be ok soon. reboots for everyone else