TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 by AdrianCX on Saturday October 31, 2026 @04:24PM (#50319772)

so just block multipath and add the firewall rule from article that drops packets with IPv4 options

[ Parent | on HN ]

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 by stefangordon on Saturday October 31, 2026 @04:48PM (#50320043)

Both of which we are finding out are apparently insufficient to mitigate this.

[ Parent | on HN ]

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 by grey-area on Saturday October 31, 2026 @04:26PM (#50319803)

Hoping fix will be out soon so we don’t have to.

[ Parent | on HN ]

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 by SoftTalker on Saturday October 31, 2026 @09:20PM (#50321876)

"the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection."

Is iptables considered an "application" here? I.e. can this bug be triggered before iptables drops the packet?

[ Parent | on HN ]

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 by vbezhenar on Sunday November 01, 2026 @02:15AM (#50323362)

Put OpenBSD in front to protect that little scared penguin.

[ Parent | on HN ]

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 by hnlmorg on Sunday November 01, 2026 @08:30AM (#50325515)

That would only work if OpenBSD is terminating that connection.

[ Parent | on HN ]

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 by suika on Sunday November 01, 2026 @11:28AM (#50327109)

OpenBSD packet filter blocks packets with IPv4 options or IPv6 hop-by-hop or destination options header by default, according to `man pf.conf`.

[ Parent | on HN ]