CVE-2026-98432 — IPv4 TCP use-after-free (inet_opt / ireq_opt)

Research PoC and local lab for a Linux kernel use-after-free reachable from a plain IPv4 TCP listener. This is a bug detector/trigger, not an exploit.

Status

• The code path is vulnerable on the analyzed build (7.0.0-38-generic): inet_sock_destruct() and tcp_v4_reqsk_destructor() free the options with kfree() instead of kfree_rcu().
• The kfree path is reachable at runtime (kprobes).
• The UAF itself is a hard, bursty race. We saw two candidate free -> use events (via=reqsk) in one old run, and could not reproduce them reliably.
• No RCE, no KASLR leak and no write primitive are implemented. The tcp2kaslr reference repo also stops at the bug trigger; later stages are not published.
• Strong confirmation requires a KASAN (or KFENCE) kernel. On the test host, CONFIG_KASAN is off and KFENCE sampling is disabled.

The correct vector (from tcp2kaslr)

MPTCP is not required. The proven path is plain IPv4 TCP:

1. The attacker sends a SYN with an IPv4 Record Route option.
2. The kernel saves the options on the request socket (ireq_opt).
3. A retransmitted SYN builds a SYNACK and reads those options.
4. The handshake completes; the child socket receives the same pointer.
5. The application accept()s the child, sets SO_LINGER(0) and closes it. inet_sock_destruct() frees the options with kfree().
6. The SYNACK path is still reading the freed memory.
7. The concurrent read/write must happen on two CPUs.

Our earlier trigger was wrong in two ways: the victim never accepted/closed the child (free_sock=0), and we sent a RST instead of relying on the server close. The current code adds the correct pieces:

• listen --accept-close — accept + SO_LINGER(0) + close.
• --sync — ACK + duplicate SYN concurrently, no RST, Record Route options.

The fix upstream is exactly:

-    kfree(rcu_dereference_protected(inet->inet_opt, 1));
+    kfree_rcu(rcu_dereference_protected(inet->inet_opt, 1), rcu);

and the same change in tcp_v4_reqsk_destructor().

Contents

Path	What
rust-poc/	the native Rust PoC: static ELF analysis, kprobes, trigger modes
lab/	Alpine + PHP loopback victim for the old local tests
scripts/	local repro helpers, authorized audit helpers
docs/FINDINGS.md	what was tested, what was confirmed, what was not
docs/EXPLOITATION-NOTES.md	scope: bug trigger only, no RCE
docs/evidence/	sanitized sample evidence

Quick start

cd rust-poc
cargo build --release

# static analysis (no root)
./target/release/cve-2026-98432 static

# runtime reachability (root, tracefs)
sudo ./target/release/cve-2026-98432 runtime

# correct local vector: accept+close server + --sync trigger
cd ..
PASSES=1 ./scripts/repro-sync.sh 8083

repro-sync.sh starts the --accept-close victim on 127.0.0.1:8083, runs the sync trigger with sudo, and prints free_sock, use_build and the UAF verdict. A clean run is not proof of safety: the rate is roughly 1e-7 per attempt and the events cluster.

If artifacts/ is missing, static/runtime fall back to /boot; the legacy scripts/cve-2026-98432.sh --static can generate the kernel artifacts.

What a positive looks like

With KASAN, the kernel reports a slab-use-after-free in inet_csk_route_req / ip_options_build with the free stack in inet_sock_destruct / inet_release. The tcp2kaslr harness reaches that in about 134k attempts with KASAN; on a normal kernel the same race was seen only twice in ~48M attempts.

Responsible use

Only test kernels and hosts you own or are explicitly authorized to test. The trigger is a kernel race and can crash the host. Use a disposable VM with a snapshot.

References

• offline-ant/tcp2kaslr — bug trigger, KASAN evidence, analysis: https://github.com/offline-ant/tcp2kaslr
• Upstream patch: ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet), kfree → kfree_rcu in net/ipv4/af_inet.c and net/ipv4/tcp_ipv4.c.

License

MIT. See LICENSE.