CVE-2026-98432

CVE-2026-98432 is a use-after-free vulnerability in the Linux kernel's IPv4 TCP handshake path, affecting kernels dating back to version 4.4. The flaw stems from a race condition involving the ownership and reclamation of IPv4 option data (such as Timestamp or Record Route options) associated with a TCP request socket. When a connection progresses, two processors can act on related request and child sockets while referencing the same IP options object. This allows one path to free the object while another continues to use it, resulting in a stale kernel pointer that can be reached through network traffic. The vulnerability gained significant attention after Anthropic demonstrated that its AI model, Claude, could generate a proof-of-concept exploit for it. The exploit targets Linux servers running a multipath TCP (MPTCP) listener, allowing a remote, unauthenticated attacker to execute arbitrary commands as root. It achieves this in two stages: first, by exploiting the race condition to leak a kernel pointer and bypass Kernel Address Space Layout Randomization (KASLR), and second, by triggering the use-after-free to overflow a buffer and overwrite a callback pointer with a staged payload. The vulnerability has since been patched upstream and backported to all maintained stable kernel branches.