Sploitus Use-After-Free Vulnerability in Linux Kernel (CVE-2026-98432)
Article Content
- •CVE-2026-98432 is a critical use-after-free vulnerability in the Linux kernel.
- •The flaw allows remote code execution through crafted TCP packets under specific conditions.
- •Patches are available for several Linux distributions, but some are still pending.
An use-after-free vulnerability (CVE-2026-98432) has been identified in the Linux kernel's TCP implementation, specifically in the `tcp_v4_syn_recv_sock()` function. This flaw allows an attacker to exploit a race condition between two CPUs, potentially leading to remote code execution via crafted TCP packets. The vulnerability affects multiple Linux distributions, including Ubuntu and Red Hat, with a CVSS score of 9.8, indicating its severity. The issue arises when a SYN-ACK response is built from freed memory, which can occur under specific network conditions. Patches have been released for several stable versions, but some distributions are still in the process of deploying fixes. The vulnerability was disclosed on October 15, 2026, and is currently considered due to its potential for exploitation. Administrators are advised to apply the available patches as soon as possible to mitigate risks.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track CVE-2026-46331 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which Linux distributions are affected?
What is the CVSS score of this vulnerability?
Have patches been released?
Continue Reading
PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like… 
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25…