# Critical Linux kernel TCP vulnerability can allow remote code execution (CVE-2026-98432)

Linux kernel IPv4 TCP use-after-free in ip_options_build() lets a remote attacker who wins a SYN/SYNACK race read or corrupt kernel memory or crash the host.

- Payout: Research
- Severity: critical
- Program: Linux kernel
- Write-up by: Aikido Security
- Disclosed: 2026-11-02
- CVE: CVE-2026-98432
- Write-up quality: 7/10
- Original: https://www.aikido.dev/blog/linux-kernel-tcp-rce-vulnerability-cve-2026-98432
- Library page: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-linux-kernel-tcp-rce-vulnerability-cve-2026-98432
- Tags: area:devices domain:network domain:oss impact:privesc impact:rce kind:research platform:threat-intel sev:critical tech:linux technique:race-window vuln:dos vuln:memory-corruption vuln:race-condition

**Target:** IPv4 TCP handshake / request socket IP options handling
**Root cause:** tcp_v4_syn_recv_sock() transfers ownership of the SYN's IP options to the child socket without copying; if another CPU is still building a SYNACK for a retransmitted SYN, the options are freed while still in use (UAF in ip_options_build()). Request socket migration (tcp_migrate_req / BPF reuseport migrate) opens a similar path.
**Steps:**
1. Attacker sends a SYN carrying IP options to an exposed IPv4 TCP port; kernel stores the options with the half-open request socket.
2. Attacker retransmits the SYN so another CPU is concurrently building a SYNACK referencing those options.
3. Child socket takes ownership of the options without copying; the options are freed while the other CPU still reads them.
4. Attacker controls timing to win the race, yielding UAF in ip_options_build(); a lost race only fails that handshake, so retry until it lands.
5. With MPTCP listener present, Anthropic's exploit leaked a kernel address (~48 min) then reached root command execution (~5 min).
**How found:** Anthropic's Frontier Red Team prompted Claude to write an exploit; the flaw was identified in ordinary IPv4 TCP request-socket IP options handling, with the race between SYN retransmit and SYNACK build as the trigger.
**Exploitation:** Remote, unauthenticated attacker races a retransmitted SYN against SYNACK construction on a host with a reachable IPv4 TCP port (Anthropic's demo required an MPTCP listener, which Go 1.24+ requests by default where the kernel allows MPTCP). Winning the race frees IP options still in use, giving read/corrupt of kernel memory; Anthropic chained an address leak to root RCE. Failed races are non-fatal, enabling repeated attempts.
**Escalation:** Kernel address leak used to defeat KASLR, then memory corruption pivoted to root command execution.
**Insight:** Half-open request sockets that hand off pointers (IP options) to child sockets without copying are a UAF surface whenever a retransmit can race the SYNACK path; check ownership-transfer patterns in handshake code, and note that per-program MPTCP disabling is fragile since one listener reopens exposure.

## Proof of concept (copied exactly from the original report)

**iptables rule dropping IPv4 packets with IP options**

```
iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP
```

**Disable MPTCP mitigation settings**

```
Set net.mptcp.enabled=0. For Go 1.24 or later programs, set GODEBUG=multipathtcp=0
```

**Verify patched kernel after reboot**

```
uname -r
Compare the output with the fixed kernel version in your vendor’s advisory. Vendors backport fixes, so use their own fixed version rather than the upstream one. If it still shows the old version, the host hasn’t rebooted into the patched kernel.
```

## Write-ups of the same bug (oldest first)
- 2026-10-31: [Linux's October 2026 TCP Use-After-Free: CVE-2026-98432 — Atlas](https://bugbountylibrary.com/r/blog%3Aatlasum-net-blog-cve-2026-98432-linux-ipv4-tcp-uaf) — Xinyang Ge
- 2026-11-02: [Critical Linux kernel TCP vulnerability can allow remote code execution (CVE-2026-98432)](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-linux-kernel-tcp-rce-vulnerability-cve-2026-98432) — Aikido Security (this one)