CVE-2026-98432
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:
ipv4: liberar inet_opt e ireq_opt después de un periodo de gracia de RCU
tcp_v4_syn_recv_sock() transfiere la propiedad de ireq->ireq_opt al socket hijo (newinet->inet_opt) sin copiarlo.
Otra CPU puede procesar concurrentemente un SYN retransmitido para el mismo socket de petición y enviar un SYNACK desde tcp_check_req(). tcp_v4_send_synack() e inet_csk_route_req() leen ireq->ireq_opt únicamente bajo rcu_read_lock(), y ip_build_and_send_pkt() e ip_options_build() leen después opt->optlen dos veces.
Tenga en cuenta que el propio temporizador de SYNACK no es un problema: mantiene una referencia a su socket de petición, e inet_csk_reqsk_queue_drop() llama a timer_delete_sync() antes de que el hijo pueda liberarse.
Leer descripción completaMostrar menos
Desde el commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), los sockets de petición se procesan sin mantener el bloqueo del socket de escucha, por lo que nada impide que el socket hijo se libere mientras aún se está construyendo el SYNACK. Los sockets hijos TCP no tienen SOCK_RCU_FREE, e inet_sock_destruct() libera inet_opt con un kfree() simple, lo que provoca un uso después de liberar en ip_options_build().
Existe un problema similar con la migración de sockets de petición (net.ipv4.tcp_migrate_req=1, o un programa BPF_SK_REUSEPORT_SELECT_OR_MIGRATE). reqsk_timer_handler() clona el socket de petición con inet_reqsk_clone(), de modo que el socket de petición antiguo y su clon comparten el mismo ireq_opt, y después reqsk_migrate_reset() pone a cero el puntero en el antiguo. Otra CPU que mantenga una referencia al socket de petición antiguo todavía puede estar usando estas opciones (enviando un SYNACK o creando un hijo en tcp_v4_syn_recv_sock()) cuando el clon se libera, y tcp_v4_reqsk_destructor() también usa un kfree() simple.
Las lecturas ya usan RCU, y otras rutas que sustituyen inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) ya usan kfree_rcu(). Use también kfree_rcu() en inet_sock_destruct() y tcp_v4_reqsk_destructor().
IPv6 no se ve afectado por el primer problema, porque tcp_v6_syn_recv_sock() duplica las opciones. tcp_v6_reqsk_destructor() tiene el mismo problema de migración con ipv6_opt, que solo lo establece CALIPSO. Esto se abordará en un parche aparte.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.17 %
- Percentil entre todas las CVEs puntuadas
- 5
- Fecha de la puntuación
- 21/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568
- https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936
- https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a
- https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036
- https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5
- https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2
- https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6
- https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98432",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"lessThan": "b3b027ef0cd322bfa839b9aaf5b27551eea54cf6",
"versionType": "git"
},
{
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"lessThan": "95a8c8fa9f27dce64c40c41c062de7728bf34ab5",
"versionType": "git"
},
{
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"lessThan": "89b5b1eb7d633c33832b7ff2c02e19a144705036",
"versionType": "git"
},
{
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"lessThan": "742f73df544e03744f2981c467d6542fe8172a2a",
"versionType": "git"
},
{
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"lessThan": "11a03ce3c4a62d84c10ccdfe47f8075006498568",
"versionType": "git"
},
{
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"lessThan": "a47406c769f72c070386985488f1c4d057df86b2",
"versionType": "git"
},
{
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"lessThan": "26d4c36d318cffbbd160884a0e4cec0da4da4936",
"versionType": "git"
},
{
"status": "affected",
"version": "079096f103faca2dd87342cca6f23d4b34da8871",
"lessThan": "e3f33b0a1d89d738e2b913dab519226eaf76e15b",
"versionType": "git"
}
],
"programFiles": [
"net/ipv4/af_inet.c",
"net/ipv4/tcp_ipv4.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.4"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.4",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.272",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.223",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.190",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.159",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/ipv4/af_inet.c",
"net/ipv4/tcp_ipv4.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-15T13:17:13.987",
"references": [
{
"url": "https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/26d4c36d318cffbbd160884a0e4cec0da4da4936",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/742f73df544e03744f2981c467d6542fe8172a2a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/89b5b1eb7d633c33832b7ff2c02e19a144705036",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/95a8c8fa9f27dce64c40c41c062de7728bf34ab5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a47406c769f72c070386985488f1c4d057df86b2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b3b027ef0cd322bfa839b9aaf5b27551eea54cf6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e3f33b0a1d89d738e2b913dab519226eaf76e15b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the\nchild socket (newinet->inet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt->optlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and inet_csk_reqsk_queue_drop()\ncalls timer_delete_sync() before the child can be freed.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock, so nothing prevents the child socket from being\nfreed while the SYNACK is still being built. TCP child sockets do\nnot have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt\nwith a plain kfree(), leading to a use-after-free in\nip_options_build().\n\nA similar issue exists with request socket migration\n(net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE\nprogram). reqsk_timer_handler() clones the request socket with\ninet_reqsk_clone(), so that the old request socket and its clone\nshare the same ireq_opt, then reqsk_migrate_reset() clears the\npointer in the old one. Another cpu holding a reference on the old\nrequest socket can still be using these options (sending a SYNACK,\nor creating a child in tcp_v4_syn_recv_sock()) when the clone is\nfreed, and tcp_v4_reqsk_destructor() also uses a plain kfree().\n\nReaders already use RCU, and other paths replacing inet_opt\n(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use\nkfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and\ntcp_v4_reqsk_destructor() as well.\n\nIPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()\nduplicates the options. tcp_v6_reqsk_destructor() has the same\nmigration issue with ipv6_opt, which is only set by CALIPSO. This\nwill be addressed in a separate patch."
}
],
"lastModified": "2026-10-19T10:18:50.010",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}