RHSB-2026-016 Use-after-free - kernel IPv4 (CVE-2026-98432)

Public Date: October 30, 2026, 16:03
갱신됨 November 4, 2026, 04:50

이 정보가 도움이 되었나요?

피드백이 취소되었습니다

Ongoing 상태

Critical Impact

Executive Summary

This vulnerability is tracked as CVE-2026-98432 and has been rated with a severity impact of Critical. Red Hat is expediting the release of fixes.

A use-after-free vulnerability was found in the Linux kernel's IPv4 networking subsystem. A remote, unauthenticated attacker could exploit a race condition during TCP connection request processing to trigger remote code execution. The flaw arises when socket options are freed while still being accessed by a concurrent operation, such as a retransmitted connection request or a socket migration. Exploitation requires precise timing of network requests but does not require any privileges or user interaction.

This vulnerability affects any system running a vulnerable kernel version with IPv4 TCP networking enabled. Since TCP is fundamental to nearly all networked services, the affected surface is broad. Systems accepting inbound TCP connections are most directly exposed. The vulnerability exists in the IPv4 TCP stack itself. While disabling MPTCP may reduce exposure in some configurations, it is not a complete mitigation. Red Hat Enterprise Linux, which disables MPTCP in its default configuration, is still vulnerable.

The investigation is ongoing and this bulletin will be updated as new information emerges. Log in with your Red Hat account, then click the "Follow" button below to be notified of changes to this bulletin.

Affected Products

The following Red Hat product versions are directly affected:

Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux 10
Red Hat OpenShift Container Platform

Further, any Red Hat product that relies on the Red Hat Enterprise Linux kernel is also potentially impacted. This includes layered products such as Red Hat OpenStack Platform, and Red Hat Virtualization.

Please ensure that the underlying Red Hat Enterprise Linux kernel is current in these product environments.

Mitigation

Overall Guidance

Filtering the affected network traffic can reduce the exposure of the vulnerable code path, but it may disrupt necessary workloads and is not a substitute for patching. Applying kernel security updates as they become available is the only complete solution, and customers are strongly recommended to update as soon as fixes are released.

Filter Incoming IPv4 Packets Containing IP Options

The following nftables table drops incoming IPv4 TCP packets that contain IP options, which reduces exposure to this vulnerability but cannot fully prevent it. Ordinary application traffic is generally expected to remain unaffected, because standard TCP options are carried in the TCP header and continue to be permitted.

Warning: Review this rule against your own traffic, network configuration, and operational requirements, and test it in a non-production environment before deploying it.

This rule is not persistent and will not survive a reboot. Customers applying it should ensure it is reapplied after any reboot that occurs before the kernel update is installed.

Procedure

Save the following to a file named cve-2026-98432.nft:

table inet cve_2026_98432 {
    chain input {
        type filter hook input priority -310; policy accept;
        ip protocol tcp ip hdrlength > 5 counter drop
    }
}

Validate and apply the rule:

sudo nft --check --file cve-2026-98432.nft
sudo nft --file cve-2026-98432.nft
sudo nft list table inet cve_2026_98432

Removal

After the kernel has been updated to a fixed version, remove the mitigation rule:

sudo nft delete table inet cve_2026_98432

Why Red Hat Recommends Packet Filtering Over Disabling MPTCP

Some organizations have recommended disabling MPTCP with sysctl -w net.mptcp.enabled=0; however, this approach only blocks one method of exploitation.

Having MPTCP enabled is not a precondition of this vulnerability. The upstream fix addresses two races in ordinary IPv4 TCP connection handling, in which socket options attached to an inbound connection request are freed while a concurrent operation is still reading them. The necessary input is IPv4 options carried on an inbound connection request, combined with one of those races, such as a retransmitted connection request or a socket migration.

Two considerations for Red Hat customers:

MPTCP support is disabled in the default Red Hat Enterprise Linux configuration. Advice to set net.mptcp.enabled=0 therefore changes nothing on a default system, and the accompanying advice to restart services does not apply to it. Such systems remain affected by this vulnerability. On a system where an administrator had previously enabled MPTCP, disabling it now will governs only sockets created after the change, so services already running would need to be restarted for it to take effect, and the system would still be affected.
Checking whether a system has MPTCP listeners is not a test for exposure. A command such as ss -Mlnp reports whether a system matches one known vulnerable configuration. It is not a complete view of whether the system is vulnerable. A result showing no MPTCP listeners should be treated as informational rather than as reassurance.

Red Hat recommends the packet filtering mitigation described above because it removes the input the flaw requires, rather than removing one configuration in which exploitation has been demonstrated. It also takes effect immediately, for both new and existing connections: the rule drops matching packets in the network stack before they reach any socket, so the state of sockets that are already open is not a factor and services that are already running do not need to be restarted.

Neither measure is a substitute for applying the kernel update.

Red Hat OpenShift Container Platform

Red Hat OpenShift Container Platform 4 is affected. All cluster nodes run Red Hat Enterprise Linux CoreOS, which includes the affected kernel. As described above, Multipath TCP is not a required condition for this flaw, and nodes in their default configuration, where MPTCP is disabled, remain affected.

Interim guidance

Red Hat has published guidance for mitigating this flaw on Red Hat OpenShift Container Platform: Mitigating CVE-2026-98432 in Red Hat OpenShift Container Platform 4. This guidance leverages the nftables rules, such as the one provided in this bulletin, across cluster nodes using MachineConfig custom resources and node disruption policies, avoid unnecessary node reboots.

The following should be taken into consideration when applying this mitigation:

The scope of this mitigation is limited to protecting the cluster from external traffic. Rules applied on a node act only on traffic traversing that node's host network namespace.
Traffic handled within the cluster's OVN-Kubernetes software-defined network, including pod to pod traffic, is not filtered, and whether externally originated traffic forwarded to pods is filtered depends on the cluster's network configuration. Filtering at the network boundary in front of the cluster is not subject to these limitations.
A mitigation for pod-to-pod traffic is not available at this time. Extending the nftables-based approach to pod traffic would require applying the rule inside every pod's network namespace individually, which is invasive at cluster scale and introduces a race condition (i.e. a pod created or rescheduled while rules are being applied could be exposed before its namespace is protected). Applying kernel security updates as they become available remains the only complete solution at this time (while alternatives mitigations continue to be explored).