CVE-2026-98432 in Linux
Summary
by MITRE • 10/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ipv4: free inet_opt and ireq_opt after an RCU grace period
tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it.
Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice.
Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed.
Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build().
A similar issue exists with request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler() clones the request socket with inet_reqsk_clone(), so that the old request socket and its clone share the same ireq_opt, then reqsk_migrate_reset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcp_v4_syn_recv_sock()) when the clone is freed, and tcp_v4_reqsk_destructor() also uses a plain kfree().
Readers already use RCU, and other paths replacing inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor() as well.
IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options. tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is only set by CALIPSO. This will be addressed in a separate patch.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The Linux kernel contains a critical use-after-free vulnerability within its IPv4 TCP implementation that arises from improper memory management of socket options during connection establishment and request socket migration. The core flaw exists in the tcp_v4_syn_recv_sock function, which transfers ownership of the ireq_opt structure to the child socket's inet_opt field without performing a deep copy. This design decision assumes exclusive access to the data, but concurrent execution paths can violate this assumption. Specifically, when another CPU processes a retransmitted SYN for the same request socket, it may trigger tcp_check_req and subsequently send a SYNACK via tcp_v4_send_synack. During this process, functions such as inet_csk_route_req read ireq->ireq_opt under an RCU read lock, while ip_build_and_send_pkt and ip_options_build access opt->optlen multiple times. Although the SYNACK timer holds a reference to its request socket, preventing immediate deallocation in that specific path, other code paths lack this protection. Since commit 079096f103fa changed TCP and DCCP handling so that syn_recv requests are processed without holding the listener lock, there is no synchronization mechanism preventing the child socket from being freed while a SYNACK packet is still being constructed on another CPU core.
The vulnerability manifests as a use-after-free condition because TCP child sockets do not utilize SOCK_RCU_FREE semantics. Consequently, when inet_sock_destruct is invoked to clean up the socket resources, it calls kfree() directly on inet_opt rather than deferring the deallocation via RCU mechanisms. This immediate free allows another CPU thread that still holds a reference to the options structure through an ongoing SYNACK transmission or other concurrent operation to access freed memory. Accessing opt->optlen twice in ip_options_build after the underlying memory has been reclaimed leads to undefined behavior, potentially resulting in kernel crashes, data corruption, or arbitrary code execution if an attacker can control the contents of the freed memory region and trigger its reallocation with malicious payloads. This represents a classic race condition where synchronization primitives are insufficiently applied across all access paths to shared mutable state.
A similar vulnerability exists within the request socket migration logic, which is activated when net.ipv4.tcp_migrate_req is enabled or through BPF programs utilizing SK_REUSEPORT_SELECT_OR_MIGRATE. In this scenario, reqsk_timer_handler clones the request socket using inet_reqsk_clone, causing both the old and new request sockets to share a pointer to the same ireq_opt structure. Subsequently, reqsk_migrate_reset clears the pointer in the old request socket instance. However, another CPU thread holding a reference to the original request socket may still be actively using these options to send a SYNACK or create a child socket via tcp_v4_syn_recv_sock before the clone is freed. The destructor for the cloned request socket, tcp_v4_reqsk_destructor, also employs plain kfree(), leading to another use-after-free condition where concurrent readers access memory that has been returned to the allocator pool. This highlights a systemic issue in how reference counting and RCU grace periods are managed across different lifecycle stages of TCP sockets during migration events.
The resolution involves aligning the deallocation strategy with existing reader patterns by replacing kfree calls with kfree_rcu in both inet_sock_destruct and tcp_v4_reqsk_destructor functions. By deferring the actual memory release until after an RCU grace period, the kernel ensures that any CPU thread currently executing within an RCU read-side critical section will complete its access to the socket options before the memory is reclaimed. This approach leverages existing infrastructure where readers already utilize RCU protection and other code paths like do_ip_setsockopt and cipso_v4_sock_setattr already employ kfree_rcu for similar purposes. It effectively eliminates the race window without requiring extensive changes to locking mechanisms, maintaining performance while ensuring memory safety.
From a classification perspective, this vulnerability corresponds to CWE-416 Use After Free, as it involves accessing memory after it has been freed due to insufficient synchronization between allocation and deallocation phases across concurrent threads. In terms of attack vectors, the potential exploitation aligns with ATT&CK techniques related to privilege escalation or denial of service through kernel-level crashes. While IPv6 is not affected by the initial SYN handling issue because tcp_v6_syn_recv_sock duplicates options rather than transferring ownership, it remains susceptible to a similar migration-related flaw involving ipv6_opt structures used in CALIPSO configurations. This separate but analogous issue requires distinct patching efforts to address the shared pointer semantics during request socket migration for IPv6 traffic flows.