Low Severity
CVE-2026-98432
Published: Oct 31, 2026
Race trigger, heap-reuse oracle, pcap analysis, detection and mitigation tooling for CVE-2026-98432 (Linux IPv4/TCP ireq_opt use-after-free).
# CVE-2026-98432 research toolkit
A small, tested laboratory toolkit for **CVE-2026-98432**, a remote
use-after-free in the Linux IPv4/TCP stack (CVSS 9.8). It contains a race
trigger with a heap-reuse oracle, a leak parser, a KASLR resolver, pcap
analysis, IDS rules and hardening helpers.
> [!WARNING]
> This is attack tooling. Run it only against machines you own, inside an
> isolated lab. The vulnerability is remote and needs no credentials on the
> target. The tool refuses public addresses unless you explicitly pass
> `--allow-public`.
## What this is
- a **trigger** for the `ireq_opt` race, with a precise, configurable timing
model;
- an **oracle** that proves memory reuse instead of guessing: every attempt
carries a unique marker in its IP options, and a SYN-ACK that echoes a
*different* attempt's marker means the kernel read a freed object;
- a **leak workflow**: anomalous SYN-ACKs are dumped to pcap, scanned for
kernel pointers, and a leaked text pointer can be turned into a KASLR slide
with a `System.map`;
- **detection and mitigation** material: pcap analyzer, Suricata rules, a
patch checker and a hardening script.
## What this is not
- not a one-click root exploit. It stops at a confirmed use-after-free and a
memory leak. Stage 3 (KASLR bypass, heap grooming, payload) is described in
[docs/analysis.md](docs/analysis.md), but not implemented: without a specific
kernel build it would be fiction.
- not a scanner. It talks to one target you name.
## Requirements
| | |
|---|---|
| Target | Linux with an IPv4 TCP listener, kernel older than the fix |
| Attacker | Linux, `CAP_NET_RAW`, a C compiler, Python 3.8+ |
| Recommended | two VMs or a VM plus a host, same L2 network |
`--mode raw` additionally needs `CAP_NET_ADMIN` to install two `iptables`
rules (the tool prints them).
## Quick start
```sh
make # builds bin/cve_2026_98432
make check # full offline test suite, no packets sent
./bin/cve_2026_9