Medium Severity
CVE-2026-98432
Published: Nov 7, 2026
CVE-2026-98432 (CVSS 9.8) Linux IPv4 TCP use-after-free Red/Blue team toolkit. Kernel exposure checks, live marker-based race proof, KASLR slide recovery from captures, pcap analysis, and one-shot host hardening. Interactive menu or direct flags, zero setup & dependencies, Python. Built for authorized security testing.
# CVE-2026-98432 – Linux IPv4 TCP Use-After-Free Toolkit
---
[](https://www.python.org/downloads/)
[](https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator)
[](https://github.com/tc4dy/CVE-2026-98432-PoC-Exploit)
[](https://www.kernel.org)
> **Ethical Use Only – Authorized Security Testing**
>
> This repository provides tools for **authorized security professionals, blue teams, and penetration testers** only.
> Unauthorized access to computer systems is illegal under **CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide**.
---
## [*] Vulnerability Overview
**CVE-2026-98432** is a use-after-free in the Linux kernel's IPv4 TCP stack. An incoming SYN carrying IPv4 options causes the kernel to save a copy of those options on the request socket. If the SYN is retransmitted at the right moment, one CPU can free that copy while another is still reading it to build the SYN-ACK, resulting in a use-after-free in `ip_options_build()`.
A second trigger exists when the server migrates pending connection requests between sockets (`net.ipv4.tcp_migrate_req=1`, or a `BPF_SK_REUSEPORT_SELECT_OR_MIGRATE` program). Both triggers share the same root cause: `inet_sock_destruct()` and `tcp_v4_reqsk_destructor()` free the options with a plain `kfree()` instead of waiting for an RCU grace period.
### > How it works
1. **Options saved on SYN** – `tcp_v4_save_options()` stores the incoming IPv4 options (`ireq_opt`) on the request socket.
2. **Ownership transferred** – `tcp_v4_syn_recv_sock()` hands `ireq_opt` to the child socket without copying it.
3. **Concurrent free** – the child socket is destroyed and `inet_sock_destruct()` releases `