TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

Red Hat raised its rating to Critical on October 30 and published a mitigation, AlmaLinux has fixed kernels in testing, and Amazon Linux has fixed all of its kernels. The Go Security Team says Go programs open multipath TCP listeners by default, so the setup Anthropic’s exploit needs is more common than it first looked. What changed.

Red Hat 于 10 月 30 日将其评级提升至“严重”（Critical）并发布了缓解措施，AlmaLinux 已在测试中修复内核，而 Amazon Linux 已修复其所有内核。Go 安全团队表示，Go 程序默认会开启多路径 TCP 监听器，因此 Anthropic 漏洞利用所需的设置比最初看起来更为常见。以下是变更内容。

Linux’s stable kernels shipped a fix on October 11 and 15, 2026 for CVE-2026-98432, a use-after-free in the IPv4 TCP handshake that a remote, unauthenticated peer can reach. The kernel’s own CVE Numbering Authority (CNA) scores it CVSS 3.1 9.8, Critical. The fixed releases are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3, and the bug goes back to Linux 4.4.

Linux 稳定版内核于 2026 年 10 月 11 日和 15 日发布了针对 CVE-2026-98432 的修复程序，这是一个存在于 IPv4 TCP 握手过程中的释放后使用（use-after-free）漏洞，远程未经身份验证的对等方即可触发。内核自身的 CVE 编号机构（CNA）将其评分为 CVSS 3.1 9.8，属于“严重”级别。修复版本包括 5.10.272、5.15.223、6.1.190、6.6.159、6.12.113、6.18.56、7.2.10 和 7.3，该漏洞可追溯至 Linux 4.4 版本。

The upstream fix is a four-line change, but most servers run a distribution’s kernel, and as of 5:15 PM CDT, October 31, Ubuntu’s tracker still reads “Vulnerable” for its kernel on every release, and Red Hat, which now rates the bug Critical too, lists RHEL 8, 9, and 10 as affected with no fix.

上游修复仅涉及四行代码的更改，但大多数服务器运行的是发行版内核。截至 10 月 31 日下午 5:15（中部夏令时间），Ubuntu 的追踪器显示其所有版本的内核仍处于“易受攻击”状态；而同样将该漏洞评为“严重”的 Red Hat 则列出 RHEL 8、9 和 10 受影响且尚无修复方案。

Linux from 4.4 on, below 5.10.272 / 5.15.223 / 6.1.190 / 6.6.159 / 6.12.113 / 6.18.56 / 7.2.10. Distribution kernels follow their own versions: check the tracker.

适用于 4.4 及以上版本，且低于 5.10.272 / 5.15.223 / 6.1.190 / 6.6.159 / 6.12.113 / 6.18.56 / 7.2.10 的 Linux 内核。各发行版内核遵循其自身的版本号：请查看相关追踪器。

Install your distribution’s fixed kernel and reboot. Debian, current SUSE Enterprise, Oracle UEK, and Amazon Linux kernels have one; Ubuntu and RHEL don’t yet.

安装您发行版提供的修复内核并重启。Debian、当前的 SUSE Enterprise、Oracle UEK 和 Amazon Linux 内核已有修复程序；Ubuntu 和 RHEL 尚未提供。

Drop TCP packets that carry IPv4 options (Atlas’s interim rule), turn off multipath TCP if you don’t use it, and patch hosts with multipath TCP listeners first.

丢弃携带 IPv4 选项的 TCP 数据包（Atlas 的临时规则），如果不使用多路径 TCP，请将其关闭，并优先为带有多路径 TCP 监听器的主机打补丁。

Why it’s urgent: the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection. Anthropic, whose researcher reported it, says its Claude model wrote a working proof-of-concept exploit that runs commands as root on “Linux servers with a multipath TCP listener,” with no credentials. Go programs open those listeners by default, per the Go Security Team. See the timeline.

紧急原因：该漏洞存在于每台 Linux 服务器在接受 IPv4 TCP 连接时运行的代码中，且发生在任何应用程序感知到连接之前。报告该漏洞的 Anthropic 公司表示，其 Claude 模型编写了一个有效的概念验证漏洞利用程序，无需凭据即可在“开启多路径 TCP 监听器的 Linux 服务器”上以 root 权限运行命令。据 Go 安全团队称，Go 程序默认会开启这些监听器。请参阅时间线。

Any Linux kernel from 4.4 on that lacks the fix, whether it serves the network directly or hosts containers: a container runs on the host’s kernel, so a new image doesn’t change anything. IPv6 connections aren’t affected by the main issue; the commit says “IPv6 is not affected by the first issue.”

任何 4.4 及以上版本且未修复的 Linux 内核，无论其是直接服务于网络还是托管容器：容器运行在宿主机内核上，因此更换新镜像无法解决问题。IPv6 连接不受此主要问题影响；提交记录显示“IPv6 不受第一个问题影响”。

Distribution kernels carry backported fixes under their own version numbers, so check the tracker, not the upstream number. As of 5:15 PM CDT, October 31:

各发行版内核携带的是基于自身版本号的向后移植修复，因此请检查追踪器，而非上游版本号。截至 10 月 31 日下午 5:15（中部夏令时间）：

When a Linux server accepts a TCP connection, the kernel tracks the half-open handshake in a lightweight “request socket,” then creates a full socket once the handshake completes. If the connecting peer’s IPv4 header carried options, the kernel keeps them to echo in its replies. The bug: the kernel handed those saved options from the request socket to the new connection without copying them, then freed them immediately when the connection went away, while another CPU could still be reading them to build a handshake reply. Reading freed kernel memory is a use-after-free.

当 Linux 服务器接受 TCP 连接时，内核会在轻量级的“请求套接字”（request socket）中跟踪半开握手，并在握手完成后创建完整套接字。如果连接对等方的 IPv4 头部携带了选项，内核会保留这些选项以便在回复中回显。漏洞在于：内核将这些来自请求套接字的已保存选项直接交给新连接，而未进行复制，随后在连接断开时立即释放了它们，此时另一个 CPU 可能仍在读取这些选项以构建握手回复。读取已释放的内核内存即为释放后使用（use-after-free）。

The peer needs no login, and it all happens inside the kernel’s handshake handling, before any application code runs. The CNA’s scoring notes say the stale data can leak kernel heap memory back to the peer, steer kernel writes out of bounds, or crash the machine. Anthropic says a lost race “only fails the handshake without crashing the whole system, so a determined attacker can retry indefinitely until they succeed.”

对等方无需登录，且这一切发生在内核的握手处理过程中，在任何应用程序代码运行之前。CNA 的评分说明指出，陈旧数据可能将内核堆内存泄露给对等方、引导内核越界写入或导致机器崩溃。Anthropic 表示，竞争失败“只会导致握手失败而不会使整个系统崩溃，因此坚定的攻击者可以无限次重试直到成功。”

Eric Dumazet’s commit, “ipv4: free inet_opt and ireq_opt after an RCU grace period,” changes two plain kfree() calls to kfree_rcu(), which waits until every reader has finished with the memory before freeing it. Other code paths that replace these options already did that. The commit also fixes the same problem in request-socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program), and says a related IPv6 case “will be addressed in a separate patch.”

Eric Dumazet 的提交“ipv4: free inet_opt and ireq_opt after an RCU grace period”将两个普通的 kfree() 调用更改为 kfree_rcu()，后者会等待所有读取者完成对内存的访问后再进行释放。其他替换这些选项的代码路径此前已采取此做法。该提交还修复了请求套接字迁移（net.ipv4.tcp_migrate_req=1 或 BPF_SK_REUSEPORT_SELECT_OR_MIGRATE 程序）中的相同问题，并指出相关的 IPv6 情况“将在单独的补丁中解决”。

Red Hat now rates it as the CNA does. It raised the bug from Important (8.1) to Critical (9.8) on October 30, citing “the lack of network prerequisites and the potential for severe system instability.” Its bulletin says “Systems accepting inbound TCP connections are most directly exposed.”

Red Hat 目前的评级与 CNA 一致。它于 10 月 30 日将该漏洞从“重要”（8.1）提升至“严重”（9.8），理由是“缺乏网络先决条件以及可能导致严重的系统不稳定”。其公告称：“接受入站 TCP 连接的系统受到的威胁最为直接。”

Compare the result with your distribution’s status above, not with the upstream version. If the installed kernel is newer than the running one, the fix isn’t active until you reboot. Run these on container hosts and Kubernetes nodes, not inside containers: a container reports the host’s kernel. We ran them on a Debian 12 host and in a Rocky Linux 9 container.

请将结果与上述发行版状态进行对比，而非与上游版本对比。如果已安装的内核比当前运行的内核更新，则修复程序在重启前不会生效。请在容器宿主机和 Kubernetes 节点上运行这些检查，而不是在容器内部：容器报告的是宿主机的内核。我们在 Debian 12 宿主机和 Rocky Linux 9 容器中进行了测试。

ss -M lists only MPTCP sockets, so an empty result means no MPTCP listener. net.mptcp.enabled = 1 alone doesn’t create one: an application has to open an MPTCP socket. We tested both with iproute2 6.1 in a Debian 12 container, where ss -Mlnp listed a test MPTCP listener and skipped a plain TCP one beside it. On October 31 it also listed a Go HTTP server whose go.mod says go 1.24, and skipped the same server built with go 1.23.

ss -M 仅列出 MPTCP 套接字，因此结果为空意味着没有 MPTCP 监听器。仅设置 net.mptcp.enabled = 1 不会创建监听器：应用程序必须主动打开 MPTCP 套接字。我们在 Debian 12 容器中使用 iproute2 6.1 对两者进行了测试，ss -Mlnp 列出了一个测试用的 MPTCP 监听器，并跳过了旁边的普通 TCP 监听器。10 月 31 日，它还列出了一个 go.mod 显示为 go 1.24 的 Go HTTP 服务器，并跳过了使用 go 1.23 构建的相同服务器。

Install your distribution’s fixed kernel as soon as it ships, then reboot: a kernel update doesn’t take effect until the machine boots into it. Reboot container hosts and Kubernetes nodes too. Appliances and cloud images that bundle a kernel need their vendor’s update.

一旦发行版发布修复内核，请立即安装并重启：内核更新只有在机器启动进入新内核后才会生效。同时重启容器宿主机和 Kubernetes 节点。捆绑内核的设备和云镜像需要等待供应商的更新。

On Debian, SUSE Linux Enterprise Server 16.0 and the 15 LTSS releases, openSUSE Leap 16.0, Oracle Linux’s UEK kernels, and Amazon Linux 2 and 2023, the fix is out. AlmaLinux’s is in its testing repository. On Ubuntu and RHEL, it isn’t out yet, as of 5:15 PM CDT, October 31. Watch the trackers linked above. Running a self-built kernel? Move to the fixed stable release for its line.

Debian、SUSE Linux Enterprise Server 16.0 和 15 LTSS 版本、openSUSE Leap 16.0、Oracle Linux 的 UEK 内核以及 Amazon Linux 2 和 2023 已发布修复程序。AlmaLinux 的修复程序位于其测试仓库中。截至 10 月 31 日下午 5:15（中部夏令时间），Ubuntu 和 RHEL 尚未发布。请关注上述链接的追踪器。运行自编译内核？请迁移至该系列已修复的稳定版本。

Red Hat’s bulletin and AlmaLinux now publish nftables rules that drop incoming IPv4 TCP packets carrying IP options. Red Hat says its rule “reduces exposure to this vulnerability but cannot fully prevent it.” The following is Atlas’s interim recommendation, the same rule as AlmaLinux’s, based on the CNA’s scoring notes, which say the attacking peer supplies IPv

Red Hat 的公告和 AlmaLinux 现已发布 nftables 规则，用于丢弃携带 IP 选项的入站 IPv4 TCP 数据包。Red Hat 表示其规则“降低了对此漏洞的暴露风险，但无法完全预防”。以下是 Atlas 的临时建议，与 AlmaLinux 的规则相同，该建议基于 CNA 的评分说明，其中提到攻击对等方会提供 IPv