CVE-2026-98432 - Linux Kernel IPv4 TCP Use-After-Free Vulnerability Scanner

A Windows and Windows Server network audit tool designed to assess remote Linux hosts for CVE-2026-98432 — a critical remote code execution (RCE) and kernel denial-of-service vulnerability affecting the Linux kernel's IPv4 TCP network stack.

---

Vulnerability Overview

Metric	Details
CVE ID	CVE-2026-98432
Vulnerability Type	Use-After-Free (UAF) / Race Condition (CWE-416)
CVSS v3.1 Score	9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Component	Linux Kernel IPv4 Networking (net/ipv4/tcp_ipv4.c, net/ipv4/af_inet.c)
Affected Versions	Linux Kernel versions 4.4 and later (prior to patched releases)
Exploitation Vector	Remote unauthenticated network attacker sending crafted IPv4 TCP SYN packets with IP options
Impact	Remote Code Execution (RCE) in kernel space, system crash (Kernel Panic / DoS), memory corruption

---

Technical Root Cause

During an incoming IPv4 TCP three-way handshake (SYN packet):

1. If the TCP connection request contains IPv4 options (inet_opt and ireq_opt), the Linux kernel stores a copy of these options in a pending connection request structure to echo them back in the SYN-ACK reply.
2. When the handshake completes, the option structure's ownership is transferred to the newly created child socket without being duplicated.
3. In vulnerable kernels, destructors (inet_sock_destruct() and tcp_v4_reqsk_destructor()) freed these options immediately using a synchronous kfree().
4. Under race conditions (such as SYN retransmissions or request socket migrations across CPU cores), another CPU core can read the option structure while it is being freed, triggering a Use-After-Free (UAF) condition.

Because this code executes inside the kernel TCP stack before incoming traffic reaches user-space applications, any listening IPv4 TCP port on the server exposes the kernel to potential remote exploitation.

---

Patched Kernel Versions

1. Upstream Stable Releases

The vulnerability was resolved upstream by Eric Dumazet (commit e3f33b0a1d89: "ipv4: free inet_opt and ireq_opt after an RCU grace period"). Minimum patched versions:

• 5.10 Branch: 5.10.272 or later
• 5.15 Branch: 5.15.223 or later
• 6.1 Branch: 6.1.190 or later
• 6.6 Branch: 6.6.159 or later
• 6.12 Branch: 6.12.113 or later
• 6.18 Branch: 6.18.56 or later
• 7.2 Branch: 7.2.10 or later
• 7.3 Branch: 7.3.0 or later

2. Major Linux Distributions

• Ubuntu 24.04 LTS: Fixed in package linux version 6.8.0-149.149 or higher
• Ubuntu 22.04 LTS: Fixed in package linux version 5.15.0-203.213 or higher
• Ubuntu 26.04 LTS: Fixed in package linux version 7.0.0-43.43 or higher
• Ubuntu 26.10: Fixed in package linux version 7.3.0-10.10 or higher
• RHEL 8 / 9 / 10 & AlmaLinux / Rocky Linux: Fixed via vendor security advisories (RHSA / ALSA)

---

Tool Architecture & Features

The scanner provides non-destructive, safe verification from any Windows workstation or server:

• Step 1: Network Reachability (ICMP Ping): Confirms host availability and network routing.
• Step 2: High-Speed TCP Port Exposure Audit: Utilizes non-blocking asynchronous .NET sockets to test standard exposed TCP ports (SSH 22, HTTP 80, HTTPS 443, Alt HTTP 8080/8443, MySQL 3306, PostgreSQL 5432, Redis 6379). Any open IPv4 TCP port indicates that the kernel TCP stack is actively receiving and processing packets.
• Step 3: Remote SSH Kernel Version & Patch Audit: Connects via native Windows OpenSSH (ssh.exe) to securely query uname -r, /etc/os-release, and active firewall mitigations without executing disruptive exploit payloads.
• Verdict & Evaluation Engine:
  • VULNERABLE: Host is running an affected kernel version without the fix.
  • SECURE / PATCHED: Host is running a patched kernel release.
  • MANUAL VERIFICATION: Custom or vendor-specific backport requires manual review.

---

How to Use

Option 1: Interactive Execution (Recommended)

Double-click check_cve_2026_98432.bat or run from CMD:

.\check_cve_2026_98432.bat

You will be prompted to:

1. Enter the target Linux server IP address (e.g. 192.168.1.100).
2. View the port exposure assessment.
3. Optionally authenticate via SSH to verify the exact kernel build.

---

Option 2: PowerShell Command Line

Full Network + SSH Audit:

powershell -ExecutionPolicy Bypass -File .\check_cve_2026_98432.ps1 -ServerIp "192.168.1.100" -SshUser "admin"

Custom SSH Port:

powershell -ExecutionPolicy Bypass -File .\check_cve_2026_98432.ps1 -ServerIp "192.168.1.100" -SshPort 2222 -SshUser "ubuntu"

Network Port Exposure Only (Skip SSH Authentication):

powershell -ExecutionPolicy Bypass -File .\check_cve_2026_98432.ps1 -ServerIp "192.168.1.100" -SkipSsh

---

Remediation & Mitigation Guide

1. Permanent Remediation (Kernel Upgrade)

Apply official security updates from your distribution's repository and reboot the server:

• Ubuntu / Debian:

  sudo apt update
  sudo apt --only-upgrade install linux-image-generic
  sudo reboot
  

• RHEL / AlmaLinux / Rocky Linux / CentOS:

  sudo dnf update kernel
  sudo reboot
  

• Arch Linux:

  sudo pacman -Syu linux
  sudo reboot
  

• Verify Current Running Kernel:

  uname -r
  

---

2. Temporary Firewall Mitigation (If immediate reboot is impossible)

The vulnerability requires TCP packets containing IPv4 options. If you cannot reboot immediately, drop all incoming TCP packets carrying IPv4 options using iptables:

# Insert rule at top of INPUT chain
sudo iptables -I INPUT 1 -p tcp -m ipv4options --any-opt -j DROP

# Persist the rule (Debian/Ubuntu)
sudo iptables-save | sudo tee /etc/iptables/rules.v4

# Persist the rule (RHEL/CentOS)
sudo service iptables save

(Note: Standard internet TCP traffic rarely utilizes IPv4 options, so dropping them typically causes no disruption to standard web, SSH, or database workloads).