cybersecurity A field note by Vikrant Sharma
A 9.8 CVSS bug in Linux TCP that should not exist
Someone found a use-after-free in the IPv4 TCP stack that has been there since kernel 2.6. Remote code execution from a malformed packet.
The Atlasum post on CVE-2026-98432 describes a use-after-free in the Linux IPv4 TCP implementation that scores 9.8 on CVSS. Remote code execution. No authentication required. Present since kernel 2.6, which shipped in 2003. The bug is in how TCP handles out-of-order segments during connection teardown. If you send a FIN packet, then a data packet that arrives late, the kernel frees the socket buffer but a dangling pointer remains in the retransmit queue. Send one more crafted packet and you can write to freed memory. What surprises me is not that the bug exists. TCP state machines are famously gnarly, full of edge cases that only happen when networks misbehave. What surprises me is that it survived two decades of fuzzing, security audits, and production traffic at every scale. The write-up includes a proof-of-concept that triggers the crash on Ubuntu 24.04 LTS. The exploit is not public yet but the author says it is reliable. Patch landed in kernel 6.12-rc3. If you run anything older than that, this is the weekend to update. Use-after-free bugs are the gift that keeps giving in C codebases. You can have millions of eyes on the code, test suites that cover every branch, and still miss the one ordering assumption that breaks when packets arrive backwards. The TCP stack is fifty thousand lines of pointer juggling. One mistake and you have a remotely exploitable memory corruption bug that sat there for twenty-three years. I have spent enough time reading MITRE ATT&CK to know that kernel networking bugs are a favourite for APT groups. They are pre-auth, they work across NAT, and they are hard to detect because the exploit traffic looks like broken packets. This one will be weaponised within weeks if it has not been already.