CVE-2026-98432 is a critical, 9.8-severity use-after-free (UAF) vulnerability in the Linux kernel’s IPv4 TCP networking stack. It allows an unauthenticated remote attacker to potentially cause system crashes, memory corruption, or execute arbitrary commands with root privileges.
From a network standpoint, the attack occurs during a manipulated TCP three-way handshake using a carefully timed sequence of packets:
- 1. The Target Packets: The attacker sends a standard connection request (SYN) packet, but includes rare, legacy IPv4 Options inside the packet header.
- 2. The Race Condition: The attacker immediately floods the server with a duplicate SYN packet. On modern multi-core servers, different CPU cores process these two rapid packets at the same time.
- 3. The Memory Error: One CPU core handles the connection and frees the memory holding the IPv4 options. Due to a lack of proper software locking, the second CPU core tries to read that exact same memory address at the same fraction of a second.
- The Result: The server reads “dirty” memory. It either packages that memory into a response packet (leaking secret kernel data back to the attacker) or executes malicious instructions embedded in the memory, granting the attacker remote root access.
We have been asked if it was possible to detect attacks based on this vulnerability, and for this reason we have enhanced nDPI to recognize it. Thanks to this extension, application (e.g. ntopng or nProbe) are automatically detecting it reporting the issue in the web interface or exported flows.
Enjoy !