Linux: a memory flaw attackers can abuse
OFFICIAL NAME: ipv4: free inet_opt and ireq_opt after an RCU grace period
DO THIS FIRSTFind out if you use it. If you do, apply the vendor's fix. Not sure if you use it? Send this page to your IT provider or security lead and ask.
TECHNICAL SUMMARY In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req().
WHY THIS VERDICT One source reports attacks and the vulnerability is 26 days old. In our backtest a single early report was confirmed within 30 days about one time in twenty, so we wait for a second report or for attack attempts to be seen.
WHY IT RANKS HERE Exploitation is reported. The first report is 9 days old.
- HIGHEST CONFIRMED RUNG
- TALK
- CISA KEV
- NOT YET
- EXPLOIT CODE
- PROOF OF CONCEPT
How far has it climbed?
01 TALK
■ CONFIRMEDNEWEST EVIDENCE · 4 INDEPENDENT SOURCESCVE-2026-98432 discussed publicly (CIRCL sighting). CVE-2026-98432 discussed publicly (CIRCL sighting).
- SRC: CIRCL Vulnerability-Lookup sightings: CVE-2026-98432 discussed publicly (CIRCL sighting) · NOV 10
- SRC: The Hacker News: Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing · NOV 3
- SRC: SANS Internet Storm Center: Mutipath TCP: Use and Detection, (Mon, Nov 2nd) · NOV 2
- SRC: The Hacker News: Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions · OCT 29
02 EXPOSED
□ NOT TRACKED YETNO SOURCE FOR THIS STEP YETWe have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.
03 TRIED
▨ REPORTED, NOT CONFIRMEDNEWEST EVIDENCE · 1 SOURCEAttacks that worked are reported (step 4), so attempts count as reported too.
04 EXPLOITED
▨ REPORTED, NOT CONFIRMEDNEWEST EVIDENCE · 1 SOURCEExploitation of CVE-2026-98432 reported (CIRCL sighting).
05 DAMAGE
□ NOT TRACKED YETNO SOURCE FOR THIS STEP YETBreach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.
When each thing happened
- DISCLOSED
- EXPLOIT CODE PUBLIC
- FIRST ATTACK REPORT
- CISA KEV LISTINGNOT YET
- US FEDERAL DEADLINENOT YET
Questions to ask this week
- Do we run Linux? If yes, is it patched or cut off from the internet?
- Who owns fixing it, and by what date?
- Have we checked for signs of attack since the first report, not just since the patch?
How it unfolded
- SEP 26, 202669 public GitHub repositories claim a proof of concept for CVE-2026-98432
- OCT 29, 2026Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
- OCT 30, 2026Linux security advisory (AV26-1108)
- Attack activity. NOV 1, 2026Exploitation of CVE-2026-98432 reported (CIRCL sighting)
- NOV 2, 2026CVE-2026-98432 discussed publicly (CIRCL sighting) (225 reports, latest NOV 10)
- NOV 2, 2026Mutipath TCP: Use and Detection, (Mon, Nov 2nd)
- NOV 3, 2026Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing
- NOV 3, 2026Public proof of concept for CVE-2026-98432 (CIRCL sighting) (8 reports, latest NOV 9)
SOURCES
- [1] CIRCL Vulnerability-Lookup sightings: CVE-2026-98432 discussed publicly (CIRCL sighting), NOV 10
- [2] CIRCL Vulnerability-Lookup sightings: Public proof of concept for CVE-2026-98432 (CIRCL sighting), NOV 9
- [3] The Hacker News: Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing, NOV 3
- [4] SANS Internet Storm Center: Mutipath TCP: Use and Detection, (Mon, Nov 2nd), NOV 2
- [5] CIRCL Vulnerability-Lookup sightings: Exploitation of CVE-2026-98432 reported (CIRCL sighting), NOV 1
- [6] Canadian Centre for Cyber Security: Linux security advisory (AV26-1108), OCT 30
- [7] The Hacker News: Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions, OCT 29
- [8] PoC-in-GitHub: 69 public GitHub repositories claim a proof of concept for CVE-2026-98432, SEP 26
- [9] CIRCL Vulnerability-Lookup sightings: 231 more reports