In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build(). A similar issue exists with request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler() clones the request socket with inet_reqsk_clone(), so that the old request socket and its clone share the same ireq_opt, then reqsk_migrate_reset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcp_v4_syn_recv_sock()) when the clone is freed, and tcp_v4_reqsk_destructor() also uses a plain kfree(). Readers already use RCU, and other paths replacing inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor() as well. IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options. tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is only set by CALIPSO. This will be addressed in a separate patch.
PoC: omnicheck_CVE-2026-98432
Non-destructive checker for CVE-2026-98432 (Linux kernel TCP use-after-free): patch status, exposed listeners and mitigation verification. By OMNIVERSE.
PoC: CVE-2026-98432-POC
Toy project
PoC: Probe-CVE-2026-98432
Local kernel version checker, remote MPTCP capability probe, and interactive scan-and-probe CLI for assessing exposure to the Linux kernel IPv4 TCP use-after-free (CVSS 9.8).
PoC: cve-2026-98432-mitigation
Temporary nftables mitigation for CVE-2026-98432 (Linux IPv4 TCP IP-options use-after-free)
PoC: cve_2026_98432_guard
Temporary eBPF/XDP mitigation for CVE-2026-98432 Linux TCP IPv4 header-options vulnerability. Helps protect unpatched systems and custom kernels until an official kernel fix can be deployed.
PoC: ansible-ezcve
Ansible role to audit Linux hosts for CVE-2026-98432 (critical IPv4 TCP use-after-free). Checks running kernel against known fixed versions, MPTCP status, and active MPTCP listeners across RHEL, Fedora, Debian, and Ubuntu. Produces clear per-host risk reports (high/medium/fixed). Read-only by default; ideal for fleet-wide inventory before patching.
PoC: tester-linux-cve-2026-98432
Vulnerability/mitigation tester for Linux-kernel CVE-2026-98432
PoC: pardus21-cve-2026-98432
Pardus 21.5 (amd64) için CVE-2026-98432 düzeltmesini Linux 5.10.262 tabanına taşıyan gayriresmî topluluk yaması. Proje, yamalı kaynak kodu, test edilen .deb paketini ve derleme, kurulum ve geri dönüş adımlarını içerir.
PoC: cve-2026-98432-mitigation
Interim mitigation for CVE-2026-98432 (Linux IPv4 TCP handshake use-after-free) on Ubuntu, until a fixed kernel ships
PoC: cve-2026-98432-defender-toolkit
Exposure audits, hunt queries and a validated interim mitigation for CVE-2026-98432, the use-after-free in the Linux IPv4 TCP handshake. Read-only scripts with a self-test. From GarphenGate Security Research.
PoC: cve-2026-98432-mitigation
cve-2026-98432-mitigation
PoC: cve-2026-98432-mitigation
Interim mitigation for CVE-2026-98432 on Ubuntu
PoC: CVE-2026-98432
CVE-2026-98432
PoC: cve-2026-98432-linux
Checklist para proteger Linux (desktop e VPS) da CVE-2026-98432
PoC: CVE-2026-98432-Checker-v-1.0-
El script hace una revisión de tu Linux frente a esa vulnerabilidad, sin tocar nada por defecto: osea mira tu kernel — lee tu versión real de Linux (uname -r) y la compara con la lista de versiones donde ya está arreglado el fallo.
PoC: kernel98scan
Is your Linux host exposed to CVE-2026-98432?
PoC: cve-2026-98432-dkms
DKMS mitigation for CVE-2026-98432
PoC: cve-2026-98432-check
Verifica se um host descarta SYN TCP IPv4 com IP options (mitigação do CVE-2026-98432)
PoC: cve-2026-98432-kernel-upgrade
Safe kernel upgrade for CVE-2026-98432 on Ubuntu 24.04 with NVIDIA, and an analysis of the bug
PoC: CVE-2026-98432-scan
CVE-2026-98432 - LINUX KERNEL IPv4 TCP USE-AFTER-FREE AUDIT CVSS 9.8 (Critical) | Remote Code Execution & Kernel Denial-of-Service
PoC: mitigate-cve-2026-98432
Use puppet to mitigate CVE-2026-98432 until vendor fixes are available.
PoC: cve-2026-98432-root-shell
CVE-2026-98432 lab root-shell kit (aid kernel; not a stock remote exploit)
PoC: linux-tcp-uaf-cve-2026-98432
CVE-2026-98432 (Linux IPv4 TCP inet_opt UAF): read-only diagnostic script, no-reboot nftables/sysctl mitigations, Ansible rollout and response guide (EN/KO)
PoC: cve-2026-98432-check
A script for cve-2026-98432 vuln
PoC: CVE-2026-98432
Mitigates CVE-2026-98432 via firewall rules
PoC: CVE-2026-98432
CVE-2026-98432: Linux Kernel TCP/IPv4 Race Condition Use-After-Free (CVSS 9.8) — PoC, Scanner, Detection Rules
PoC: cve-2026-98432-mitigation-rpm
RPM package that applies an nftables mitigation for CVE-2026-98432 (RHSB-2026-016) on EL 8/9/10
PoC: drop-ipv4-opt
XDP program to mitigate CVE-2026-98432
PoC: xboard-core
Xboard 节点后端：基于 Xray-core v26.10.31，单补丁实现设备数/限速，严格对齐 Xboard V2 契约，内置 CVE-2026-98432 缓解
PoC: CVE-2026-98432
PoC for CVE-2026-98432 (Linux kernel IPv4 TCP inet_opt/ireq_opt use-after-free, CVSS 9.8): KASAN-verified UAF reproduction in inet_csk_route_req with A/B fixed-kernel control
PoC: debian-cve-2026-98432-fix
One-click kernel security update for CVE-2026-98432 on Debian 12/13.
PoC: cve-2026-98432-ebpf
eBPF (XDP/tc) mitigation for CVE-2026-98432 / RHSB-2026-016 - untested draft
PoC: cve-2026-98432-ubuntu-mitigation
Check an Ubuntu host for CVE-2026-98432 and, after you confirm, apply the interim Red Hat RHSB-2026-016 mitigation. Ubuntu 20.04 to 26.10.
PoC: cve-2026-98432-nft-mitigation
Interim nftables mitigation for Linux kernel CVE-2026-98432 (IPv4-options UAF in tcp_v4_syn_recv_sock) as a reproducible agent skill
PoC: cve-2026-98432
Stopgap firewall mitigation for CVE-2026-98432 on Ubuntu 16.04/24.04
PoC: synipopt
IPv4 SYN with IP options, one lab target per run, for CVE-2026-98432 research. Header-offset parser, regression tests, and a postmortem of a broken auto-exploiter.
PoC: cve-2026-98432-guard
Temporary mitigation for CVE-2026-98432 on AlmaLinux 8/9/10 and Ubuntu. Not a kernel fix.
PoC: cve-2026-98432
Detector and local lab for CVE-2026-98432 (IPv4 TCP UAF in inet_opt/ireq_opt): static analysis, kprobes, the tcp2kaslr trigger vector, and remote-risk evidence. Not an exploit; no RCE.
PoC: fix_CVE-2026-98432
Ansible playbook to mitigate CVE-2026-98432
PoC: cve-2026-98432-mitigation
Interim nftables mitigation for CVE-2026-98432, automatic rollback and Russian administrator guide. Not a kernel patch.
PoC: cve-2026-98432-validation-mitigation
Read-only patch-state and exposure check for CVE-2026-98432 (Linux kernel IPv4 TCP use-after-free, CVSS 9.8), with opt-in interim mitigation and exact rollback.
PoC: tcp2kaslr
CVE-2026-98432: a plain IPv4 TCP server is vulnerable, MPTCP is not the trigger. Bug trigger, evidence and analysis.
PoC: cve-2026-98432
Proof-only PoC for CVE-2026-98432 (Linux IPv4/TCP ireq_opt use-after-free): race trigger, heap-reuse oracle, no code execution
PoC: ubuntu-noble-tcp-rcu-backport
Ubuntu Noble backport and regression evidence for the upstream CVE-2026-98432 IPv4 RCU lifetime repair
PoC: netprobe-cve-2026-98432
You should patch, but not worry about CVE-2026-98432
PoC: CVE-2026-98432-PoC-Exploit
CVE-2026-98432 ( Linux IPv4 TCP use-after-free toolkit. Detect kernel exposure, trigger the race, analyze captures, recover KASLR slides, and lock down hosts. Single command, zero setup, standard library only. Built for real-world authorized security testing.
PoC: cve-2026-98432-ubuntu-analisis
Analisis dan panduan remediasi CVE-2026-98432 untuk Ubuntu 22.04 LTS
PoC: cve-2026-98432-ubuntu-backport
Source-validated Ubuntu 6.8 backport candidate for Eric Dumazet’s upstream CVE-2026-98432 fix, with provenance and CI. Not yet compiled or boot-tested.
PoC: Paranoid-CVE-2026-98432
Drop incoming IPv4 TCP packets whose IP header contains options.
PoC: cve-2026-98432-checker
Check a Linux server for CVE-2026-98432 (IPv4 TCP use-after-free, CVSS 9.8): root cause explained, read-only check script and mitigations.
PoC: netviser-linux-security-auditor
Read-only, agentless Linux kernel security configuration auditor (local & SSH). Initial focus: TCP migration / MPTCP checks for CVE-2026-98432.
PoC: CVE-2026-98432
CVE-2026-98432 (Linux IPv4 TCP use-after-free): how to check your server, apply a stopgap, and clean up after the fix
PoC: CVE-2026-98432
Race trigger, heap-reuse oracle, pcap analysis, detection and mitigation tooling for CVE-2026-98432 (Linux IPv4/TCP ireq_opt use-after-free).
PoC: ubuntu-tcp-guide
우분투 커널 TCP 구멍(CVE-2026-98432) 쉽게 보기 · 벨로키 보안 공부
PoC: CVE-2026-98432
Linux kernel IPv4 SYN IP-options use-after-free CVE-2026-98432 Mitigation work (Ansible Role)
PoC: cve-2026-98432-mitigation
Temporary mitigation for CVE-2026-98432 (Linux IPv4 TCP ireq_opt use-after-free): drop IPv4 TCP with IP options, disable MPTCP. Tested scripts + verification. EN/KO.
PoC: kpatch-cve-2026-98432
kpatch livepatch for CVE-2026-98432 (and CVE-2026-99999) on AlmaLinux and Rocky Linux 8, 9 and 10
PoC: cve-2026-98432-audit
cve-2026-98432 audit script (ipv4 TCP inet_opt/ireq_opt use-after-free)
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free