Low Severity
CVE-2026-98432
Published: Nov 1, 2026
Proof-only PoC for CVE-2026-98432 (Linux IPv4/TCP ireq_opt use-after-free): race trigger, heap-reuse oracle, no code execution
# CVE-2026-98432 — Linux IPv4/TCP `ireq_opt` use-after-free PoC
Proof-only proof of concept for CVE-2026-98432 (CVSS 9.8): a remotely
triggerable use-after-free in the Linux IPv4/TCP stack.
**For authorized security testing only.** Run it against systems you own or
have explicit permission to test.
---
## What it proves
The PoC triggers the race and detects when the kernel copies bytes out of a
freed `ip_options_rcu` object into a SYN-ACK. It **does not** create users or
files, and it does **not** implement a code-execution chain.
A hit means the server returned another allocation's marker inside its
SYN-ACK — a correct kernel cannot do that. In a controlled test on Ubuntu
24.04.5 with kernel `6.8.0-147-generic` (listed vulnerable by Ubuntu; fix
queued in `6.8.0-149`), a 180-second loopback run produced **21 hits in
320,829 attempts**, and a 300-second run produced **22 hits in 616,911
attempts**. The kernel stayed clean (`tainted=0`, no oops).
No packet captures or logs from that host are included here; the PoC's own
output is the evidence.
---
## 1. The bug
A SYN carrying IPv4 options makes the kernel build an `ip_options_rcu`
(72 bytes, `kmalloc-96`) for the request socket. When the handshake completes,
`tcp_v4_syn_recv_sock()` hands that object to the child socket **without
copying it**, then clears the pointer in the request socket. A second CPU that
already looked the request socket up can still be inside
`tcp_check_req()` → `tcp_v4_send_synack()` → `ip_build_and_send_pkt()` →
`ip_options_build()`, reading the same object. Child sockets are not
`SOCK_RCU_FREE`, and `inet_sock_destruct()` frees `inet_opt` with a plain
`kfree()`, so if the child is torn down in that window the reader dereferences
freed memory.
A second variant exists with request-socket migration
(`net.ipv4.tcp_migrate_req=1` or a BPF reuseport program); the fix uses
`kfree_rcu()` in both `inet_sock_destruct()` and `tcp_v4_reqsk_destructor()`.
Introduced in Linux 4.4 (`079096f103fa`)