A significant vulnerability, labeled CVE-2026-98432, impacts the Linux kernel's IPv4 TCP implementation, allowing remote attackers to exploit systems for remote memory corruption This article explores vulnerability arises tcp_v4_syn_recv_sock. . Reports indicate that Anthropic demonstrated unauthenticated remote root execution against Linux servers running a Multipath TCP listener, which should not be confused with all potential vulnerable deployments.
This assessment highlights the critical memory safety flaw in the underlying TCP implementation, distinguishing it from the necessary conditions for reliable code execution.
The vulnerability arises in the tcp_v4_syn_recv_sock() function, which transfers ownership of IPv4 options from the request socket’s ireq->ireq_opt field to a newly created child socket without copying them. Simultaneously, another processor can handle a retransmitted SYN associated with the same request and begin constructing a SYNACK response through tcp_check_req(). Crucially, the SYNACK timer is not responsible: it retains a request socket reference, and the relevant teardown path synchronously deletes the timer before freeing the child.
Cloning temporarily shares two request sockets' option memory, and freeing the clone invalidates options accessed through the original socket. However, Ubuntu encounters a related IPv6 migration problem involving CALIPSO options, and a separate patch is needed to address it. Several fixes remain in the "work in progress" status, including generic kernels for Ubuntu 22.04, 24.04, 26.04, and 26.10.
However, other kernel streams remain pending.
