CVE-2026-98432: Patched kernels available in testing

Key points

AlmaLinux has put patched kernels in its testing repository for CVE-2026-98432. The flaw is a use-after-free in the kernel code that sets up incoming IPv4 TCP connections, rated CVSS 9.8 (Critical) by the Linux kernel CVE team. AlmaLinux 8, 9 and 10 are affected, and the project asks users to help verify the kernels before they go to production, ahead of any fixed RHEL kernel.

The vulnerability

• An attacker triggers it over the network with a SYN that carries IPv4 options, sent to a listening IPv4 TCP port. No privileges or user interaction are needed, and it happens before any application sees the connection.
• The kernel stored the SYN's options with the pending request and passed them uncopied to the new socket. If the client retransmits its SYN, another CPU can still be building a SYN-ACK from those options after the socket has been closed and freed, so it reads freed memory.
• A related path exists when TCP request socket migration is enabled, through the net.ipv4.tcp_migrate_req sysctl or a BPF program that migrates requests. Migration is off by default.
• The bug dates back to Linux 4.4.
• The upstream fix is e3f33b0a1d89 ("ipv4: free inet_opt and ireq_opt after an RCU grace period") by Eric Dumazet. It frees the options only once no other CPU can still read them.
• IPv6 connections are not affected by the main issue.

Who is affected

• Any AlmaLinux system that accepts IPv4 TCP connections from untrusted networks should be treated as exposed.
• The bug was reported by an Anthropic researcher. Anthropic says its exploit gives a remote attacker root command execution on servers with a multipath TCP (MPTCP) listener.
• MPTCP is disabled by default on AlmaLinux. The flaw is in the ordinary IPv4 TCP code, though, so systems without MPTCP still need the fix.

Patched kernels

• AlmaLinux 8: kernel-4.18.0-553.180.2.el8_10
• AlmaLinux 9: kernel-5.14.0-687.61.2.el9_8
• AlmaLinux 10: kernel-6.12.0-211.69.2.el10_2
• Install the listed version for your release or a newer one.
• The core team backported the fix from the 5.10, 5.15 and 6.12 stable kernels. No fixed RHEL kernel existed at the time of writing, and ALESCo, the technical steering committee, approved shipping ahead of CentOS Stream / RHEL.
• The kernels move to the production repositories after community verification, and the post will be updated when that happens.

How to test

sudo dnf install -y almalinux-release-testing
sudo dnf update 'kernel*' --enablerepo=almalinux-testing
sudo reboot

• After rebooting, compare uname -r or rpm -q kernel with the versions above.
• If you do not want the testing repo to stay enabled (the post says production machines almost certainly do not), disable it after the reboot:

sudo dnf config-manager --disable almalinux-testing

• Report problems in AlmaLinux chat or on bugs.almalinux.org.

Temporary mitigation without a reboot

• This nftables rule drops incoming IPv4 TCP packets that carry options. Regular traffic almost never uses them.
• It coexists with firewalld, can be run repeatedly, and was tested on AlmaLinux 8, 9 and 10.

sudo nft -f - <<'EOF'
add table ip cve_2026_98432
delete table ip cve_2026_98432
table ip cve_2026_98432 {
chain prerouting {
type filter hook prerouting priority -300; policy accept;
meta l4proto tcp ip hdrlength > 5 counter drop
}
}
EOF

• nft comes from the nftables package, which is installed with firewalld. If it is missing, run sudo dnf install -y nftables first.
• The rule is lost on reboot, so run it again if you reboot before installing the patched kernel.
• Check that the rule is active (the counter shows dropped packets) with sudo nft list table ip cve_2026_98432.
• Remove it with sudo nft delete table ip cve_2026_98432.

Mitigation caveats

• The rule covers the host and containers whose traffic passes through it, which is the default for Podman and Docker. Traffic between containers on the same host may bypass it.
• On systems that route traffic for other machines, forwarded TCP packets with IPv4 options are dropped too.
• Do not use it on networks that rely on CIPSO security labels (NetLabel). The kernel adds those options itself, so the rule would not protect that setup anyway.
• IPv6 traffic does not need the rule.

MPTCP check

• sysctl net.mptcp.enabled should print net.mptcp.enabled = 0.
• If it prints 1 and you do not need MPTCP, disable it now and across reboots:

echo 'net.mptcp.enabled = 0' | sudo tee /etc/sysctl.d/90-disable-mptcp.conf
sudo sysctl -w net.mptcp.enabled=0

• This only prevents new MPTCP sockets. List the remaining MPTCP listeners with sudo ss -lnMp and restart the services that own them.
• Neither the firewall rule nor the MPTCP setting fixes the bug. Install the patched kernel and reboot as soon as possible.

Summary by DistroNews, based on the original post.