AlmaLinux patches critical CVE-2026-98432 kernel use-after-free ahead of RHEL

AlmaLinux has published patched kernels for CVE-2026-98432, a critical use-after-free vulnerability in Linux kernel IPv4 TCP connection setup code, across all supported releases (8, 9, and 10) in its testing repository. The flaw, rated CVSS 9.8 by the Linux kernel CVE team, allows remote unauthenticated attackers to trigger memory corruption through crafted SYN packets carrying IPv4 options, with Anthropic demonstrating root command execution against systems with multipath TCP listeners enabled. AlmaLinux's technical steering committee ALESCo authorized shipping ahead of CentOS Stream and RHEL updates, which were not yet available at publication time.

The vulnerability affects all Linux kernels back to 4.4 and stems from premature freeing of IPv4 option copies during TCP handshake processing. AlmaLinux ships with MPTCP disabled by default, reducing immediate exploitability, but the underlying bug exists in standard IPv4 TCP code. The project is soliciting community testing before promoting the packages to production repositories, and has provided nftables-based mitigation rules for administrators who cannot immediately reboot.

Vulnerability mechanics and kernel fix

• CVE-2026-98432 defect class: Use-after-free in IPv4 TCP connection request handling, specifically in code that copies and later frees IPv4 options attached to incoming SYN packets before ensuring no other CPU references them.
• Attack vector: Remote, unauthenticated, network-reachable; triggered by IPv4 TCP SYN packets with options to any listening port, with demonstrated privilege escalation to root when multipath TCP (MPTCP) listeners are active.
• Affected scope: Linux kernels from 4.4 through current; IPv6 connections are not affected by the primary issue. The tcp_migrate_req sysctl and BPF-based request migration expose a similar race condition but are disabled by default.
• Upstream fix: Commit e3f33b0a1d89 by Eric Dumazet defers freeing of inet_opt and ireq_opt structures until after an RCU grace period expires, matching existing safe patterns elsewhere in the networking stack.
• AlmaLinux backports: Kernel versions kernel-4.18.0-553.180.2.el8_10, kernel-5.14.0-687.61.2.el9_8, and kernel-6.12.0-211.69.2.el10_2 derived from upstream stable kernels 5.10, 5.15, and 6.12 respectively, released to almalinux-testing repository ahead of RHEL fixes.

Why it matters

This early patch release demonstrates how RHEL-compatible distributions can outpace upstream during critical security windows, giving AlmaLinux administrators a head start on remediation that CentOS Stream and RHEL users currently lack. The project's transparent handling—including detailed nftables mitigation rules, explicit MPTCP configuration guidance, and community validation workflow—sets a practical standard for downstream security response that benefits the broader enterprise Linux ecosystem, particularly for organizations running container workloads or internet-facing services on AlmaLinux.