TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
CVE-2026-98432 is a CVSS 9.8 remote use-after-free in Linux's IPv4 TCP handshake, fixed upstream Oct 15. Ubuntu and RHEL haven't shipped a fixed kernel yet.
Quick read
A technical writeup of CVE-2026-98432, a remote use-after-free in Linux's IPv4 TCP handshake rated CVSS 9.8 and fixed upstream in mid-October 2026. It explains which Linux kernels and distributions are affected, mitigations, and why hosts with multipath TCP listeners are especially at risk.
- Check your distribution kernel tracker for a backported fix
- Install a fixed kernel from your distro and reboot immediately
- Temporarily drop IPv4 TCP options and disable multipath TCP if unused
Reactions
No reactions yet. Record a short about this link and it shows up here, in Reels and in the community feed.
Is atlasum.net your site? Sign in to verify it and get a Verified badge, full stats and a link-back badge.
A closer look at TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
What this Atlasum post is about
This page covers CVE-2026-98432, a use-after-free in the Linux IPv4 TCP handshake that the Linux kernel CNA scores CVSS 3.1 9.8 (Critical). It summarizes the upstream fixes that landed in stable kernels (examples listed include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3) and notes the bug goes back to Linux 4.4.
What you can do after reading this writeup
Follow the page’s practical advice: install your distribution’s fixed kernel and reboot, or apply interim mitigations such as dropping TCP packets that carry IPv4 options and turning off multipath TCP if you do not use it. The post also highlights distribution-specific guidance and kernel availability status so you should check your distro tracker for the appropriate fixed kernel.
Which systems and admins should care
Any Linux kernel from 4.4 onward that lacks the fix is affected, including hosts that run containers because containers use the host kernel. The post calls out that the flaw occurs before an application sees the connection, and mentions systems with multipath TCP listeners are explicitly exploitable by a proof-of-concept reported by the researcher; it also notes IPv6 is not affected by the main issue. The writeup lists distribution and vendor status (RHEL, AlmaLinux, Ubuntu, SUSE, Debian, etc.) so system and cloud admins will find the tracking and mitigation details useful.
Questions people ask about TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
- Has my distribution shipped a fix?
- The page lists many distributions and kernel versions with fixed or in-testing status; check the tracker entry for your specific release as noted on the page.
- Does turning off multipath TCP fully mitigate the issue?
- The post says turning off multipath TCP does not fix the bug, though it recommends turning it off if you do not use it and prioritizing patching hosts that run multipath TCP listeners.
- Do containers protect me from this bug?
- No; the page explains containers run on the host kernel, so a new container image does not avoid the need to patch the host kernel.
TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 was shared on NexURLs by Nexis on November 1, 2026, in Tech & AI.
What we found on this site
- Built with
- Next.js
- Served through
- Cloudflare
- Home page answered in
- 111 ms
- Trackers
- None found
- Ads
- None found
- RSS feed
- No
- AI crawlers
- Lets them in
- llms.txt
- Yes
- Set up for phones
- Yes
- Real-visitor speed
- Passes Core Web Vitals
- Popularity
- Top 200,000 domain (Cloudflare)
- Google safety check
- No threats found
- Domain registered
- 2026
- Domain renews
- April 2027
Checked November 1, 2026 from the site’s own code and public records. See how the rest of the web compares in the NexURLs Internet Report.
Featured in
Quick answers
What is TCP Use-After-Free?
TCP Use-After-Free (atlasum.net): A technical writeup of CVE-2026-98432, a remote use-after-free in Linux's IPv4 TCP handshake rated CVSS 9.8 and fixed upstream in mid-October 2026. It explains which Linux kernels and distributions are affected, mitigations, and why hosts with multipath TCP listeners are especially at risk.
Who shared TCP Use-After-Free on NexURLs?
It was shared by Nexis in November 2026. Every link on NexURLs is shared by a real member and passes a safety check before it goes out.
What are some sites like TCP Use-After-Free?
Members found these close to it: Remote Code Execution Vulnerability in Google, Upcoming PHP security release, Observations from Running stealmybitcoin. The full list is on this page under Sites like TCP Use-After-Free.
Sites like TCP Use-After-Free
- Remote Code Execution Vulnerability in Googlesimonkoeck.com
This site details a remote code execution vulnerability found in Google’s Flask session cookies. It provides insights...
- Upcoming PHP security release (CVE-2026-109618 / -109619)news-web.php.net
- Observations from Running stealmybitcoinpavursec.com
A first-person account of an experiment that deployed a vulnerable PHP site (stealmybitcoin.com) to test whether the...
- CVE-2026-106173: FortiSIEM gRPC Path Traversal to RCEhorizon3.ai
A Horizon3 research deep-dive describing CVE-2026-106173, a FortiSIEM gRPC vulnerability that allows unauthenticated...
- Protecting against CVE-2026-98432groups.google.com
- CWE Top Most Dangerous Software Weaknessescwe.mitre.org
More Tech & AI finds
- Unauthorized Access to PingCAP Cloud Resourcespingcap.com
- MailAccess - the true Email OSINT frameworkmailaccess.pro
- Swurf - Swipe through the real webswurf.org
- Jevman - AI decision models play Pac-Manopper.ai
- The cryptography behind electronic voting (and why paper ballots are stillblog.trailofbits.com
- Man-in-the-middle arbitrary code execution in Debian’s aptlists.debian.org
Feeling lucky? Try the random website generator.
Where people went next
Nobody has added a next stop yet. Be the first.