tc4dy/cve-2026-98432-poc-exploitToolkit for CVE-2026-98432 Linux TCP use-after-free: kernel patch checks, race oracle triggering, pcap UAF analysis, KASLR slide recovery, and nftables hardening.
Ethical Use Only – Authorized Security Testing
This repository provides tools for authorized security professionals, blue teams, and penetration testers only. Unauthorized access to computer systems is illegal under CFAA (US), Computer Misuse Act (UK), TCK 243/244 (Turkey), and similar laws worldwide.
CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP stack. An incoming SYN carrying IPv4 options causes the kernel to save a copy of those options on the request socket. If the SYN is retransmitted at the right moment, one CPU can free that copy while another is still reading it to build the SYN-ACK, resulting in a use-after-free in ip_options_build().
A second trigger exists when the server migrates pending connection requests between sockets (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). Both triggers share the same root cause: inet_sock_destruct() and tcp_v4_reqsk_destructor() free the options with a plain kfree() instead of waiting for an RCU grace period.
tcp_v4_save_options() stores the incoming IPv4 options (ireq_opt) on the request socket.tcp_v4_syn_recv_sock() hands ireq_opt to the child socket without copying it.inet_sock_destruct() releases inet_opt with a plain kfree().tcp_v4_send_synack() → ip_options_build(), which reads the already-freed options.The upstream fix is commit e3f33b0a1d89 ("ipv4: free inet_opt and ireq_opt after an RCU grace period"), which converts both frees to kfree_rcu(). IPv6 is not affected by the main issue.
5.15.0-xxx with the upstream numbers. Check the vendor's own security tracker.| Date | Observation | Source |
|---|---|---|
| 2026-11-04 | Ubuntu 22.04 LTS (and newer) still has the fix only in -proposed; standard -updates users remain on a vulnerable kernel until the fix is promoted. MPTCP is enabled by default on affected releases, though the bug is not MPTCP-specific. | Ubuntu CVE Tracker · Ubuntu Blog – Fixes in -proposed |
| 2026-11-02 | AWS confirms the flaw affects Linux kernel 4.4+ and that Ubuntu-based Lightsail blueprints are in scope; mitigation is to install a patched kernel or apply a temporary firewall rule dropping IPv4 TCP packets with IP options. | AWS Docs – Address CVE-2026-98432 on Lightsail |
| 2026-10-15 | Official kernel CVE announcement: the root cause is the missing RCU grace period before kfree() of inet_opt / ireq_opt; fixed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3-rc7. | Linux CVE Announce – Openwall |
Note: These observations confirm exposure (vulnerable kernel + default MPTCP on stock Ubuntu) and the official fix status; they are not a confirmation that the exploit in this repository executed successfully on any specific host.
| Tool | Purpose | Intended User |
|---|---|---|
cve_2026_98432 | Red and blue team toolkit. Source and runtime patch checks, network probe, race oracle with marker reuse detection, pcap analysis, KASLR slide recovery, and mitigation guidance. Single command with an interactive menu or direct flags. | Red teams, blue teams, authorized pentesters |
--check | Local kernel version and source tree inspection. | Blue teams, auditors |
--probe | Confirm a TCP listener is reachable and IPv4 SYN options reach the stack. | Red teams, blue teams |
--race | Marker-based race oracle. Sends crafted SYNs and inspects SYN-ACKs for cross-flow marker reuse. | Red teams (Prob) |
--pcap | Offline pcap analysis. Detects UAF evidence and kernel pointer candidates. | Blue teams (Partial) |
--map | KASLR slide recovery from leaked text pointers using a System.map. | Red teams (Partial) |
--harden | Apply or preview mitigations (MPTCP off, migration off, IP-option drop). | Blue teams (Prob) |
| Label | Meaning |
|---|---|
| (unlabelled) | Deterministic. Same input, same output. |
| (Prob) | Race outcomes can vary between runs. The tool repeats attempts for a bounded duration. |
| (Partial) | Depends on correct input. The tool works when a valid pcap or a matching System.map is provided. |
| Feature | Status | Notes |
|---|---|---|
| Source tree patch check | Deterministic | Reads af_inet.c and tcp_ipv4.c, looks for kfree_rcu in both destructors. |
| Running kernel check | Deterministic | Compares uname -r against the fixed version table. |
| Network probe | Deterministic | Opens a TCP connection and sends a minimal HTTP request. |
| Race oracle | (Prob) | Sends crafted SYNs, observes marker reuse in SYN-ACKs. Requires root and CAP_NET_RAW. |
| Pcap analysis | (Partial) | Parses pcap, looks for cross-flow marker reuse and kernel pointer candidates. |
| KASLR slide recovery | (Partial) | Needs a matching System.map and at least one leaked text pointer. |
| Mitigation apply | (Prob) | Writes nftables rules and sysctls. The rule drops IPv4 TCP packets carrying IP options. |
| Mass scan | Deterministic | CIDR, file, or single target. Async with rate limiting and progress output. |
| JSON / JSONL / CSV | Deterministic | Chosen by output file extension. |
| Proxy / Tor / jitter | Deterministic | Applied to every network operation. |
| Resume | Deterministic | Saves completed target:port pairs to a state file. |
git clone https://github.com/tc4dy/CVE-2026-98432-PoC-Exploit
cd CVE-2026-98432-PoC-Exploit
# No requirements; no extra pip packages needed.