Critical Linux Kernel Vulnerability Lets Remote Attackers Crash Ubuntu Systems

A critical vulnerability in the Linux kernel, identified as CVE-2026-98432, threatens Ubuntu systems through a networking memory flaw that could cause crashes and service disruptions.

Ubuntu released an advisory on October 15, 2026, and provided an update on October 29. The vulnerability has been assigned a CVSS severity score of 9.8, indicating a high priority for remediation.

The Ubuntu security advisory describes a use-after-free vulnerability in IPv4 TCP connection handling. Although the defect can cause a crash, the published description does not describe a reliable remote exploit or confirm active exploitation.

Linux Kernel Vulnerability

The vulnerability originates in tcp_v4_syn_recv_sock(), which transfers ownership of IP options from a request socket’s ireq->ireq_opt pointer to a newly created child socket without copying the underlying data.

Meanwhile, another processor can handle a retransmitted SYN packet for the same request and build a SYNACK response through tcp_check_req(). Functions including tcp_v4_send_synack() and inet_csk_route_req() access those shared options under an RCU read lock.

The problem emerges when the child socket is destroyed before SYNACK construction finishes. Because inet_sock_destruct() releases inet_opt using ordinary kfree(), concurrent readers can access freed memory inside ip_options_build(). Request sockets have operated without the listener lock since commit 079096f103fa, enabling this dangerous overlap.

A related race affects request socket migration when net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is used. Cloned request sockets temporarily share ireq_opt, allowing one processor to continue reading options after another frees the clone.

The correction replaces immediate deallocation with kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor(). This defers memory reclamation until existing RCU readers finish, addressing the lifetime mismatch. Similar synchronization failures have featured in other Linux kernel RCU memory-safety research.

Ubuntu’s tracker lists the generic kernels for releases 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS as vulnerable, with fixes in progress. Listed target builds must not be mistaken for released security updates. Older releases and multiple cloud kernel variants also appear as vulnerable.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.