Linux Kernel Use-After-Free Flaw Explained

What happened

Linux has addressed a vulnerability in the Linux Kernel, the core software that manages a system's hardware and networking. Think of it like someone throwing away a shared shopping list while another person is still reading it. In this case, networking code can release a piece of memory while another part of the kernel still needs its contents.

The issue, tracked as CVE-2026-98432, involves overlapping work during TCP connection handling. TCP is the protocol that manages connections for many network applications. Under the circumstances described by NVD, connection cleanup can free network option information while the kernel is still using it to prepare a response.

The vendor's advisory lists corrected kernel releases across several release branches. NVD published the vulnerability on 2026-10-15 and assigns it a CRITICAL severity rating. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-10-30.

Technical details

The weakness is a use-after-free: code accesses memory after that memory has been released. The underlying race condition occurs when concurrent operations interact in an unsafe order. Here, a request socket, which tracks a pending connection, transfers ownership of network option memory to a child socket, which represents the developing connection. That transfer does not create a separate copy.

Another processor can handle a retransmitted SYN, a message used to initiate a TCP connection, for the same request. While it builds a SYNACK, the connection acknowledgment response, it can still read the shared option memory. Meanwhile, the child socket can be freed, and its cleanup releases that memory immediately. The result is a stale memory access in ip_options_build().

The readers use RCU, short for read-copy-update, a mechanism that allows concurrent access while delaying reclamation of shared data. The fix delays freeing the option memory until an RCU grace period has passed, allowing existing protected readers to finish. The described failure depends on overlapping connection processing and socket cleanup; the description does not establish a complete attack procedure or a specific outcome such as code execution. It also distinguishes this race from the SYNACK timer, whose reference handling and synchronized removal are described as sufficient.

NVD assigns CVE-2026-98432 a CVSS 3.1 score of 9.8, rated CRITICAL. CVSS is a standardized measure of vulnerability severity, so this rating supports giving the update high priority. The score alone does not establish the precise consequences for a particular machine. No CWE classification is supplied.

Who is affected

Everyday users

For everyday users, the relevant software is the operating system's kernel. Updating a browser or another individual application does not by itself confirm that this kernel issue has been fixed. Use your Linux distribution's supported update process and follow the update steps in the vendor's advisory.

An installed update and a running update are different things. After updating, complete any restart required by the vendor and check the kernel that is actually running. A familiar desktop experience does not indicate whether the corrected kernel is active.

Developers

For developers, the important distinction is between application behavior and the kernel code underneath it. This advisory concerns TCP connection processing inside the Linux Kernel. Reviewing application dependencies or rebuilding an application does not establish that the underlying kernel has been corrected.

The technical lesson is about ownership and lifetime: transferring a pointer to another object does not mean concurrent readers have stopped using it. In this case, safe cleanup must account for readers that remain inside an RCU-protected operation. When checking development systems and servers, identify the running kernel and match its update status to the vendor's advisory.

Server and IT admins

Server and IT administrators should identify the running kernels across their systems and map them to the applicable vendor update guidance. The advisory lists fixes at 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. Treat those as the listed correction points for their respective release lines, and consult the vendor's advisory when interpreting the overlapping affected-version entries.

Prioritize deployment and activation of the relevant kernel update, then verify each system after any required restart. CVE-2026-98432 is not listed in the CISA Known Exploited Vulnerabilities catalog, commonly called KEV, as of the catalog check. That catalog status should not replace assessment of the CRITICAL severity rating or the system's update status.

What to do now

1. Identify the running Linux Kernel version on each relevant system. Record the result so you can compare it with the kernel running after the update.
2. Match the system to the vendor's affected-version guidance. The listed ranges include >= 4.4 and < 5.10.272; >= 5.15 and < 5.15.223; >= 6.1 and < 6.1.190; and >= 6.6 and < 6.6.159.
3. Also check the remaining listed ranges: >= 6.12 and < 6.12.113; >= 6.18 and < 6.18.56; >= 7.2 and < 7.2.10; and the broader entry earlier than 7.3. Because these entries overlap, use the vendor's advisory to determine the applicable release-line fix.
4. Follow the update steps in the vendor's advisory. The listed corrected releases are 5.10.272 and later, 5.15.223 and later, 6.1.190 and later, 6.6.159 and later, 6.12.113 and later, 6.18.56 and later, 7.2.10 and later, and 7.3 and later, as applicable to the release line.
5. Complete any restart required to activate the corrected kernel. Then check the running version again and confirm that the vendor identifies it as containing the fix for CVE-2026-98432.

uname -r

sudo apt update && sudo apt upgrade

sudo dnf upgrade

How to confirm the fix

• Check the running kernel after completing the vendor's update procedure and any required restart. Do not rely solely on the package installation having finished.
• Compare the running kernel with the corrected release for the applicable release line, using the vendor's advisory to resolve the overlapping version entries.
• Confirm that the vendor's update information explicitly covers CVE-2026-98432, and retain that confirmation with the system's update record.

NVD scores and CISA KEV status

As of October 30, 2026, none of these CVEs is listed in the CISA Known Exploited Vulnerabilities catalog.

Affected products and fixed versions 8 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Linux advisory: https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/2026/CVE-2026-98432.dyad
• NVD: CVE-2026-98432
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on October 30, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.