Security / CVE-2026-98432

Linux kernel IPv4 TCP option lifetime use-after-free

A race in Linux kernel IPv4 TCP connection handling can free inet_opt data while another CPU is still reading it under RCU protection. The Ubuntu record describes possible use-after-free access while building a SYN-ACK packet; a similar race can occur during request-socket migration. The upstream fix changes the relevant frees to kfree_rcu().

CVSS ratings

CVSS v3.1 · 9.8 · CriticalCVSS v4.0 · 8.3 · High

Abora Team Priority

Abora P5 · Critical / Urgent

Abora OS assessment

Stable channel

Abora release assessment

Affected

Edge channel

Abora prerelease assessment

Investigating

Affected components

Linux kernel
IPv4 TCP connection/request-socket handling

Ubuntu's CVE record identifies vulnerable kernel lines including 7.0 and 7.3; its package status is distribution-specific. The branch fix list is evaluated against each Abora kernel line, while Abora-specific backports remain unverified.

Version ranges and Abora release impact

Upstream Linux versions affected: Linux kernel versions 4.4 and newer are affected until the fix is present. Compare each kernel against its own branch's fixed version below; branches without a listed fix remain affected upstream unless a vendor backport is confirmed.
Upstream versions with fixes: Versions below the first fixed version on the same branch are affected. A higher version on a different branch is not proof of a fix; verify branch-specific backports.

Available fixed versions by kernel branch

Kernel branch and first fixed version
Kernel branch	First fixed version
6.12	6.12.113
6.18	6.18.56
7.2	7.2.10
7.3	7.3-rc7

Affected status and recommended action for each Abora release for CVE-2026-98432
Abora release	Release date	Linux kernel	CVE-2026-98432 status	What to do
v4.2 Solstice	In development	TBD	Cannot assess The release kernel is not specified.	Confirm the final kernel version, then reassess this CVE.
v4.1 Horizon	October 3, 2026	Linux 7.2.9	Affected 7.2.9 is earlier than the 7.2 fix at 7.2.10.	Update to 7.2.10 or verify an Abora backport.
v4.0 Everest (2026.08.28)	August 29, 2026	Linux 7.2	Affected This kernel branch is affected below 7.2.10; the Abora patch level is not provided.	Treat this branch as affected until the exact build is confirmed at or above 7.2.10, or a backport is verified.
2026.07.27 Alpha	July 27, 2026	Linux 7.x	Needs verification The kernel label 7.x is too broad to compare with the affected range and branch fixes.	Get the full kernel version, including patch level, then compare it with the branch fix.
v3 Denali (v3.14)	June 2026	Linux 7.0 / 7.1	Affected This kernel is in the upstream affected range from 4.4; no fix is listed for this branch.	Treat as affected until Abora confirms a backport or provides a fixed kernel for this branch.
v2.5.0 / v2	May / June 2026	Linux 7.0	Affected This kernel is in the upstream affected range from 4.4; no fix is listed for this branch.	Treat as affected until Abora confirms a backport or provides a fixed kernel for this branch.
v1.0.1 / v1	March 26, 2026	Linux 6.19 / 7.0	Affected This kernel is in the upstream affected range from 4.4; no fix is listed for this branch.	Treat as affected until Abora confirms a backport or provides a fixed kernel for this branch.
v36 (First Beta)	March 17, 2026	Linux 6.19	Affected This kernel is in the upstream affected range from 4.4; no fix is listed for this branch.	Treat as affected until Abora confirms a backport or provides a fixed kernel for this branch.

Affected status is based on the upstream kernel version and branch fix. An Abora vendor backport can change package-level exposure; verify the shipped kernel package.