CVE-2026-98432

Public on 2026-10-15
Modified on 2026-10-30
Description
A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol (TCP) connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could exploit this vulnerability by sending specially timed network requests, triggering a use-after-free condition. This issue primarily results in a system crash leading to a Denial of Service (DoS) or potential memory corruption.
Severity
Important severity
Important
See what this means
CVSS v3 Base Score
8.1
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core kernel 2026-10-30 ALAS2-2026-4065 Fixed
Amazon Linux 2 - Kernel-5.10 Extra kernel 2026-10-30 ALAS2KERNEL-5.10-2026-137 Fixed
Amazon Linux 2 - Kernel-5.15 Extra kernel 2026-10-30 ALAS2KERNEL-5.15-2026-120 Fixed
Amazon Linux 2 - Kernel-5.4 Extra kernel 2026-10-30 ALAS2KERNEL-5.4-2026-135 Fixed
Amazon Linux 2023 kernel 2026-10-30 ALAS2023-2026-3365 Fixed
Amazon Linux 2023 kernel6.12 2026-10-29 ALAS2023-2026-3335 Fixed
Amazon Linux 2023 kernel6.18 2026-10-24 ALAS2023-2026-3251 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H