Low Severity
CVE-2026-98432
Published: Oct 31, 2026
CVE-2026-98432 (CVSS 9.8) Linux IPv4 TCP use-after-free full toolkit. Detect kernel exposure, trigger the race, analyze captures, recover KASLR slides, and lock down hosts. Single command, zero setup, standard library only. Built for real-world authorized security testing.
# CVE-2026-98432 – Linux IPv4 TCP Use-After-Free Toolkit
---
[](https://www.python.org/downloads/)
[](https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator)
[](https://github.com/tc4dy/CVE-2026-98432-PoC-Exploit)
[](https://www.kernel.org)
> **Ethical Use Only – Authorized Security Testing**
>
> This repository provides tools for **authorized security professionals, blue teams, and penetration testers** only.
> Unauthorized access to computer systems is illegal under **CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide**.
---
## [*] Vulnerability Overview
**CVE-2026-98432** is a use-after-free in the Linux kernel's IPv4 TCP stack. An incoming SYN carrying IPv4 options causes the kernel to save a copy of those options on the request socket. If the SYN is retransmitted at the right moment, one CPU can free that copy while another is still reading it to build the SYN-ACK, resulting in a use-after-free in `ip_options_build()`.
A second trigger exists when the server migrates pending connection requests between sockets (`net.ipv4.tcp_migrate_req=1`, or a `BPF_SK_REUSEPORT_SELECT_OR_MIGRATE` program). Both triggers share the same root cause: `inet_sock_destruct()` and `tcp_v4_reqsk_destructor()` free the options with a plain `kfree()` instead of waiting for an RCU grace period.
### How it works
1. **Options saved on SYN** – `tcp_v4_save_options()` stores the incoming IPv4 options (`ireq_opt`) on the request socket.
2. **Ownership transferred** – `tcp_v4_syn_recv_sock()` hands `ireq_opt` to the child socket without copying it.
3. **Concurrent free** – the child socket is destroyed and `inet_sock_destruct()` releases `in