CVE-2026-98432 is a remotely triggerable use-after-free in IPv4 TCP connection setup. A SYN carrying IPv4 options sent to any listening IPv4 TCP port can cause ip_options_build() to read freed memory while a SYN-ACK is built, because inet_sock_destruct() and tcp_v4_reqsk_destructor() free the options with plain kfree(). A remote root exploit against MPTCP listeners has been demonstrated. The bug has been present since Linux 4.4.

Upstream fix: commit e3f33b0a1d89 "ipv4: free inet_opt and ireq_opt after an RCU grace period" (Eric Dumazet), first released in 7.3, 7.2.10, 6.18.56, 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272.

Current Kali kernels predate the fix:

• kali-rolling / kali-dev: linux 7.1.5-1kali1 (2026-08-25)
• kali-experimental: linux 7.2.9-1kali1 (2026-10-05), one release short of 7.2.10

Debian already ships fixed kernels in forky (7.2.12-1) and sid (7.2.14-1), with DSA-6568-1 for trixie and DLA-4841-1 for bookworm.

Request: please rebase onto a fixed upstream release (7.2.10 or later, or 7.3) or backport e3f33b0a1d89 into kali-rolling.

Steps to reproduce:

1. On kali-rolling, run uname -r and apt-cache policy linux-image-amd64.
2. Observe that the installed and candidate kernels (7.0.12-2kali1 / 7.1.5-1kali1) are older than 7.2.10 and that their changelogs do not contain e3f33b0a1d89 or CVE-2026-98432.

Interim mitigations for users until a fixed kernel lands:

• sysctl -w net.mptcp.enabled=0
• nftables: drop IPv4 TCP packets with IP options at prerouting priority -300 (meta l4proto tcp ip hdrlength gt 5 drop)

References:

• https://security-tracker.debian.org/tracker/CVE-2026-98432
• https://app.opencve.io/cve/CVE-2026-98432
• https://tuxcare.com/cve-tracker/cve/details/cve-2026-98432/

Reported by: Goat Robotics R&D