# Linux's October 2026 TCP Use-After-Free: CVE-2026-98432 — Atlas

IPv4 TCP handshake use-after-free in Linux kernel: saved inet_opt/ireq_opt freed without RCU grace period, letting a remote unauthenticated peer read freed heap or corrupt kernel memory.

- Payout: Research
- Severity: critical
- Program: Linux kernel
- Write-up by: Xinyang Ge
- Disclosed: 2026-10-31
- CVE: CVE-2026-98432
- Write-up quality: 7/10
- Original: https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf
- Library page: https://bugbountylibrary.com/r/blog%3Aatlasum-net-blog-cve-2026-98432-linux-ipv4-tcp-uaf
- Tags: area:devices domain:network domain:oss impact:data-leak impact:privesc impact:rce kind:research platform:research sev:critical tech:linux technique:race-window technique:source-review vuln:dos vuln:memory-corruption vuln:race-condition

**Target:** IPv4 TCP handshake handling (request socket option data, net/ipv4)
**Root cause:** The kernel handed saved IPv4 options from the request socket to the new connection without copying them, then freed them immediately when the connection went away, while another CPU could still be reading them to build a handshake reply.
**Steps:**
1. Send a SYN to a listening IPv4 TCP socket with IPv4 Record Route or Timestamp options in the header so the kernel saves them in the request socket.
2. Complete the handshake so the options are passed to the new full socket without being copied.
3. Trigger connection teardown so the options are kfree()'d while another CPU is still reading them to build a handshake reply.
4. Race the free against the reader; a lost race only fails the handshake, so retry indefinitely until the stale read/write lands.
5. On servers with an MPTCP listener, Anthropic's PoC leaks a kernel pointer in ~48 minutes and reaches root command execution ~5 minutes later.
**How found:** Anthropic researcher Xinyang Ge (Claude-assisted) identified the missing RCU grace period: other code paths replacing these options already used kfree_rcu(), but the handshake path used plain kfree().
**Exploitation:** Remote unauthenticated peer sends crafted IPv4 options in the SYN; the freed option buffer is read/written by the handshake path on another CPU. Anthropic's Claude-built PoC targets Linux servers with a multipath TCP listener (Go programs open these by default since Go 1.24) and achieves arbitrary command execution as root with no credentials or user interaction; exploit not published.
**Escalation:** Retry the race indefinitely since a lost race only fails the handshake; MPTCP listener presence enables the working root exploit chain.
**Insight:** When auditing kernel object lifetimes, diff free paths against sibling code paths that already use kfree_rcu() — a plain kfree() where peers use RCU is a strong UAF signal, especially on per-CPU-readable handshake state reachable pre-auth.

## Proof of concept (copied exactly from the original report)

**nftables rule dropping IPv4 TCP packets with options**

```
nft add table ip cve_2026_984322nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'3nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop
```

**iptables raw-table rule dropping TCP with IP options**

```
iptables -t raw -I PREROUTING -p tcp -m u32 --u32 "0>>24&0xF=6:15" -j DROP
```

**Commands to disable multipath TCP via sysctl**

```
echo 'net.mptcp.enabled = 0' | sudo tee /etc/sysctl.d/90-disable-mptcp.conf2sudo sysctl -w net.mptcp.enabled=03sudo ss -Mlnp # listeners opened earlier stay MPTCP: restart their services
```