TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 by jamilbk on Sunday November 01, 2026 @11:32AM (#50327151)

Here's the NIST link: https://nvd.nist.gov/vuln/detail/cve-2026-98432

Here are my notes so far after digging into this with Claude + defensive access:

1. Not just an MPTCP thing - any received IPv4 packet with options creates the problematic conditions.

2. Also appears that using NetLabel/CIPSO (SELinux or Smack with a CIPSOV4 mapping) creates the same conditions that a packet with IP options would. If you're using these, it might mean that dropping IPv4 packets with IP options might not fully mitigate.

3. At least for our test VMs in Azure (accelerated networking) I wasn't able to get any IPv4 packets with options through, from three different US-based ISPs. Unfortunately Microsoft publishes no docs on whether the fabric drops this or not, so YMMV.

We're using a simple XDP program to mitigate until a patched kernel is available (thanks @tptacek for the idea):

https://github.com/jamilbk/drop-ipv4-opt

[ Parent | on HN ]

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 by dachris on Sunday November 01, 2026 @01:05PM (#50328010)

Claude suggested this nftables-ipopt config + systemd unit to survive reboot will also fix the issue. Can anyone comment whether this is early enough in the stack to also solve this?

  cat > /etc/nftables-ipopt.nft <<'EOF'
  table inet ipopt {
    chain pre {
      type filter hook prerouting priority raw - 10; policy accept;
      ip hdrlength != 5 counter drop
    }
  }
  EOF

Also couldn't get IPv4 packets with options through between Hetzner cloud servers (different networks), but it's no guarantee.

[ Parent | on HN ]