CVE-2026-98432

A MODERATE severity use-after-free flaw in the Linux kernel's IPv4 TCP implementation affects the kernel packages of Red Hat Enterprise Linux 8, 9, and 10 (including the Real Time kernel), Red Hat In-Vehicle OS 2, and the RHEL CoreOS-based nodes shipped with OpenShift Container Platform 4. tcp_v4_syn_recv_sock() transfers the IPv4 request socket options (ireq->ireq_opt) to the child socket without copying them; because request sockets are processed without holding the listener lock, another CPU handling a retransmitted SYN for the same request socket can still be reading those options, for example in ip_options_build() while a SYNACK is being built, when the child socket is destroyed and the options are freed with a plain kfree(). A similar hazard exists during TCP request socket migration, which is enabled by net.ipv4.tcp_migrate_req=1 or by a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program. A remote, unauthenticated attacker able to reach an exposed TCP service could exploit this race condition with specially timed network requests, most likely causing a kernel crash and denial of service, with a theoretical potential for memory corruption. The Red Hat CVSS:3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects the high attack complexity of winning the race, and no confidentiality or integrity impact has been demonstrated. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in that kernel, and Red Hat Enterprise Linux 6 is out of support scope. IPv6 is not affected by the primary issue because tcp_v6_syn_recv_sock() duplicates the options. Fixes for the affected products are currently deferred to a future update; until then, the residual risk is limited by the high attack complexity of the race, with denial of service being the practical worst case.