No known exploitationHIGH

Linux kernel IPv4 TCP race lets remote attackers crash hosts; no known exploitation

A race in Linux kernel IPv4 TCP connection handling can free socket options that are still in use, so a remote attacker can crash the host. No exploitation is reported. Install your distribution's fixed kernel and reboot.

Linux (kernel.org) Linux kernel (IPv4/TCP networking)CVE-2026-98432CVSS8.1Endpoint & OS
Published Nov 1, 2026

The Amazon Linux and SUSE advisories do not mention exploitation or a public PoC. VulnDigest's record shows the CVE is not in CISA KEV, but searches for exploitation reports did not complete.

Oct 15, 202615 daysOct 30, 2026

What you need to know

  • Exposure: Linux hosts that accept IPv4 TCP connections. Fixed kernels are out for Amazon Linux 2, Amazon Linux 2023, and SUSE's real-time kernel on SLE Micro 5.5 and openSUSE Leap 15.5.
  • Impact: a remotely triggered race causes a use-after-free. Vendors say a kernel crash is the main outcome, with memory corruption possible. Scores range from 8.1 (vendors) to 9.8 (NVD).
  • Exploitation: none reported and no public PoC known. VulnDigest's record shows it is not in CISA KEV.
  • Fix: install the vendor kernel and reboot, or load the vendor livepatch. The Amazon Linux 2023 6.1 fix is kernel-6.1.189-236.400.amzn2023.
  • Detect: compare running kernels (uname -r) with the fixed builds, and check kernel logs on TCP-facing hosts for unexplained oops or panics.

What's happening

CVE-2026-98432 is a race condition in the Linux kernel's IPv4 networking code that can cause a use-after-free of socket options 1. According to Amazon Linux, a remote attacker would need precisely timed network requests to trigger it, and the most likely result is a system crash, with memory corruption also possible 1. Amazon Linux and SUSE have shipped fixed kernels 1,2.

Severity scores disagree. NVD rates the flaw 9.8 with low attack complexity, while SUSE and Amazon Linux both score it 8.1 with high attack complexity 1,2. SUSE's CVSS 4.0 score is 9.2 2. No reviewed source shows that code execution is practical, so this brief treats denial of service as the established impact and uses the vendor 8.1 score.

Neither the Amazon Linux nor the SUSE advisory mentions in-the-wild exploitation or a public proof of concept 1,2. VulnDigest's record shows the CVE is not in CISA's KEV catalog. Searches for exploitation and scanning reports did not complete, so the absence of reports is not confirmation that none exist.

How it works

The bug is in how the kernel handles incoming TCP connection requests over IPv4. Two paths are affected: concurrent processing of retransmitted connection requests, and socket migration. In either case, the socket options can be freed while another code path is still using them 1. The result is a use-after-free reached through a race 1.

The upstream fix is titled 'ipv4: free inet_opt and ireq_opt after an RCU grace period', and SUSE tracks it as bsc#1285685 2,3. Delaying the free of the inet_opt and ireq_opt structures until after an RCU grace period lets concurrent readers finish before the memory is released.

Amazon Linux describes the attacker as remote, sending specially timed requests 1. Any host that accepts inbound IPv4 TCP connections should therefore be treated as exposed. Winning the race depends on timing, which is why SUSE and Amazon Linux rate attack complexity High rather than Low 1,2. The CNA description includes further detail on specific kernel functions and a socket-migration variant. That detail was not checked against the kernel.org commits for this brief and is left out.

What to do

In order of priority
  1. 1

    Patch: install the fixed vendor kernel and reboot. On Amazon Linux 2023 (6.1), apply ALAS2023-2026-3365, which ships kernel-6.1.189-236.400.amzn2023. The advisory gives dnf update kernel --releasever 2023.12.20261102 as the update command 3.

  2. 2

    Amazon Linux 2 and the other Amazon Linux 2023 kernel streams: apply ALAS2-2026-4065, ALAS2KERNEL-5.4-2026-135, ALAS2KERNEL-5.10-2026-137, ALAS2KERNEL-5.15-2026-120, ALAS2023-2026-3335 (kernel6.12) or ALAS2023-2026-3251 (kernel6.18) as appropriate 1.

  3. 3

    SUSE: SUSE-SU-2026:4938-1 (important, 2026-10-29) fixes the real-time kernel on SLE Micro 5.5 and openSUSE Leap 15.5 (kernel-rt 5.14.21-150500.13.167.2). Install it with zypper patch, then reboot 2. Other SUSE products are not covered by this advisory.

  4. 4

    For other SUSE products and for Red Hat, Ubuntu, Debian and other distributions, check the vendor's advisory for CVE-2026-98432. Those advisories were not reviewed for this brief.

  5. 5

    If an immediate reboot is not possible, apply the vendor livepatch where one is offered. Amazon lists a kernel-livepatch package for 6.1.189-236.400 3. The reviewed advisories publish no configuration workaround.

  6. 6

    Restrict exposure until patched. Prioritize internet-facing hosts and hosts that accept connections from untrusted networks, and limit inbound TCP to required sources with security groups or host firewalls.

  7. 7

    No pre-patch exploitation is reported, so credential rotation is not indicated. Investigate any unexplained kernel crashes on exposed hosts since 2026-10-15 1, and keep crash dumps (kdump) for analysis.

Detection

  • Check exposure against the running kernel (uname -r), not just the installed package. On Amazon Linux 2023 the 6.1 fix is kernel-6.1.189-236.400.amzn2023 3. A host that installed the update but has not rebooted is still running the vulnerable kernel.
  • On Amazon Linux, list pending security advisories with dnf updateinfo list (Amazon Linux 2023) or yum updateinfo list (Amazon Linux 2). Look for ALAS2023-2026-3365, ALAS2023-2026-3335, ALAS2023-2026-3251, ALAS2-2026-4065 and the ALAS2KERNEL-5.4, 5.10 and 5.15 advisories 1,3.
  • On SUSE Linux Enterprise Micro 5.5 and openSUSE Leap 15.5 running the real-time kernel, confirm that SUSE-SU-2026:4938-1 (bsc#1285685) is installed and that the host has rebooted into kernel-rt 5.14.21-150500.13.167.2 or later 2.
  • Where a livepatch is used instead of a reboot, confirm the livepatch module is loaded on each host, not only installed. Amazon ships a kernel-livepatch package for 6.1.189-236.400 3.
  • Hunt for crash symptoms on hosts that expose TCP services: kernel oops, panic or general protection fault messages in journalctl -k, /var/log/messages or serial console output, and unexplained reboots in instance or hypervisor telemetry. Triage any stack traces that point into IPv4/TCP code.
  • The reviewed sources publish no indicators, signatures or scanner templates. Because the trigger is a timing-dependent kernel race, network-based detection of attempts is unlikely to be reliable. Use version inventory as the primary control.

Timeline

  1. CVE-2026-98432 made public (Amazon Linux 'Public on' date). 1

  2. Amazon Linux 2023 kernel6.18 fix released (ALAS2023-2026-3251). 1

  3. SUSE releases SUSE-SU-2026:4938-1 (important), fixing kernel-rt on SLE Micro 5.5 and openSUSE Leap 15.5. 2

  4. Amazon Linux 2023 kernel6.12 fix released (ALAS2023-2026-3335). 1

  5. Amazon Linux 2 fixes and the Amazon Linux 2023 6.1 kernel fix (ALAS2023-2026-3365) released. 1

Sources

  1. 1
    CVE-2026-98432
    Amazon Linux Security Center · Vendor · Oct 30, 2026
  2. 2
    SUSE-SU-2026:4938-1: important: Security update for the Linux Kernel
    SUSE · Vendor · Oct 29, 2026
  3. 3
    ALAS2023-2026-3365
    Amazon Linux Security Center · Vendor · Oct 30, 2026

Corroborated by independent sources. Researched and drafted by the VulnDigest briefs agent from 3 sources, then checked against them by a separate review step on Nov 1, 2026.

Scores differ: NVD rates this 9.8 (AV:N/AC:L), while Amazon Linux and SUSE rate it 8.1 (AV:N/AC:H). SUSE's CVSS 4.0 score is 9.2. This brief uses the vendor 8.1 score.

The no-exploitation status rests on two vendor advisories that do not mention exploitation and on VulnDigest's KEV record. CISA KEV was not re-checked, and searches for exploitation reports did not complete.

SUSE-SU-2026:4938-1 covers only the real-time kernel on SLE Micro 5.5 and openSUSE Leap 15.5. Other SUSE products and kernel flavors need their own advisories.

Upstream kernel.org fixed versions and Red Hat, Ubuntu and Debian advisories were not reviewed. Check your distribution's advisory.

Exact package versions for Amazon Linux 2 and the Amazon Linux 2023 kernel6.12 and kernel6.18 streams were not retrieved. Use the listed advisory IDs.

ALAS2023-2026-3365 was revised after release (updated 2026-11-02). Check the update command against the live advisory.

Spotted an error? Open an issue on sochub.io.