# CVE-2026-98432: Linux kernel ipv4 use-after-free in TCP option handling

Source: https://junglewise.ai/threats/cve-2026-98432-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-98432 · Severity: high · Published 2026-10-15

The Linux kernel contains a use-after-free vulnerability in its TCP/IPv4 networking stack that could allow an attacker to read or write kernel memory. The vulnerability occurs when processing SYN packets and TCP option structures, potentially enabling privilege escalation or system compromise. This affects systems with TCP functionality, which includes nearly all Linux deployments.

Technologies: [Amazon AWS](https://junglewise.ai/threats/technologies/aws), [Google Cloud Platform](https://junglewise.ai/threats/technologies/google-cloud-platform), [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon), [Google](https://junglewise.ai/threats/vendors/google), [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-98432 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-98432 being exploited in the wild.

**How severe is CVE-2026-98432?** High severity, published 15 October 2026.

**Which products and versions are affected?** Linux Kernel versions before the fix.

**Is there a fix for CVE-2026-98432?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-98432 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-98432?** Check whether you run Amazon AWS, Google Cloud Platform or Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in tcp_v4_syn_recv_sock() and related functions where inet_opt and ireq_opt structures are freed without respecting RCU grace periods. Concurrent SYN retransmissions can cause one CPU to free the option structure while another CPU is still reading it in ip_options_build(). The fix involves converting plain kfree() calls to kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor() to ensure proper synchronization. The issue affects TCP child socket creation and request socket migration paths.

## Affected products

- Linux Linux kernel versions before the fix

## Timeline

- 2026-10-15: disclosed

## Related threats

- [An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0)](https://junglewise.ai/threats/cve-2026-126793-privilege-escalation-in-aurora-postgresql-dialect-detection-in)
- [AWS SDK for pandas EMR unverified bucket ownership](https://junglewise.ai/threats/cve-2026-127119-unverified-ownership-of-the-default-emr-cluster-log-location-in)
- [Amazon mcp-gateway-registry server-side request forgery in registration API](https://junglewise.ai/threats/cve-2026-125926-server-side-request-forgery-in-the-server-registration-and)
- [Amazon mcp-gateway-registry authorization bypass in management API](https://junglewise.ai/threats/cve-2026-100307-missing-authorization-on-the-external-management-api-in-mcp)
- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)