The Linux kernel CVE Numbering Authority published CVE-2026-98432 on 15 October 2026 (12:08 UTC; 20:08 Perth) for a use-after-free in the kernel's IPv4 TCP code, fixed by the commit 'ipv4: free inet_opt and ireq_opt after an RCU grace period'.

The CVE record says tcp_v4_syn_recv_sock() hands the request socket's IP options to the child socket without copying them, so another CPU sending a SYNACK for a retransmitted SYN can still be reading them after the child socket frees them with a plain kfree(), leading to a use-after-free in ip_options_build(); a similar issue exists with request socket migration. The kernel CNA rates it CVSS 3.1 9.8 (Critical) and its scoring notes say an unauthenticated peer supplies IPv4 Record Route or Timestamp options in a TCP SYN to a listening service, and races a retransmitted SYN against completing and tearing down the same connection; it says reclaiming the freed object can disclose adjacent kernel heap contents to the peer, permit out-of-bounds kernel writes and potential control-flow corruption, or crash the kernel.

The CVE record lists the flaw as affecting kernels from 4.4 and fixed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Ubuntu's CVE page (last updated 28 October) gives it Ubuntu priority High and lists the linux package as vulnerable in releases from 16.04 to 26.10, with fixes marked work in progress for 22.04, 24.04, 26.04 and 26.10.

IPv6 is not affected by the first issue, according to the CVE record. (source: CVE record; Ubuntu)