CVE-2026-98432

{
  "etk_id": "ETK-2026-3117",
  "cve_id": "CVE-2026-98432",
  "display_id": "CVE-2026-98432",
  "ghsa_id": "GHSA-qp6h-4hvh-qqqc",
  "euvd_id": "EUVD-2026-102025",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Use-after-free in Linux IPv4 TCP option handling",
  "summary": "Affected Linux kernels can release IPv4 TCP option data while concurrent request processing still uses it. An attacker able to reach an IPv4 TCP service and induce relevant concurrent connection or retransmission handling may trigger a use-after-free; TCP request migration adds another affected path when enabled.",
  "mitigation": "Install your distribution's kernel update that includes the upstream fix. Until then, disable TCP request migration by setting net.ipv4.tcp_migrate_req=0 where feasible; this reduces only the migration-related exposure.",
  "vendor": "Linux",
  "product": "Linux",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 079096f103faca2dd87342cca6f23d4b34da8871, < b3b027ef0cd322bfa839b9aaf5b27551eea54cf6",
        ">= 079096f103faca2dd87342cca6f23d4b34da8871, < 95a8c8fa9f27dce64c40c41c062de7728bf34ab5",
        ">= 079096f103faca2dd87342cca6f23d4b34da8871, < 89b5b1eb7d633c33832b7ff2c02e19a144705036",
        ">= 079096f103faca2dd87342cca6f23d4b34da8871, < 742f73df544e03744f2981c467d6542fe8172a2a",
        ">= 079096f103faca2dd87342cca6f23d4b34da8871, < 11a03ce3c4a62d84c10ccdfe47f8075006498568",
        ">= 079096f103faca2dd87342cca6f23d4b34da8871, < a47406c769f72c070386985488f1c4d057df86b2",
        ">= 079096f103faca2dd87342cca6f23d4b34da8871, < 26d4c36d318cffbbd160884a0e4cec0da4da4936",
        ">= 079096f103faca2dd87342cca6f23d4b34da8871, < e3f33b0a1d89d738e2b913dab519226eaf76e15b"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "b3b027ef0cd322bfa839b9aaf5b27551eea54cf6",
        "95a8c8fa9f27dce64c40c41c062de7728bf34ab5",
        "89b5b1eb7d633c33832b7ff2c02e19a144705036",
        "742f73df544e03744f2981c467d6542fe8172a2a",
        "11a03ce3c4a62d84c10ccdfe47f8075006498568",
        "a47406c769f72c070386985488f1c4d057df86b2",
        "26d4c36d318cffbbd160884a0e4cec0da4da4936",
        "e3f33b0a1d89d738e2b913dab519226eaf76e15b"
      ],
      "package_name": "Linux",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "4.4"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Linux",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "other",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.0858071,
  "t0_at": "2026-10-15T12:08:22.205000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-15T12:08:22.205000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-15T12:08:22.205000+00:00",
      "url": "https://www.bleepingcomputer.com/news/security/linux-kernel-exploit-enables-remote-root-attacks-on-mptcp-servers/"
    }
  }
}