Critical [CVE-2026-98432] Linux kernel RCE CVE-2026-98432
This critical-severity Fortinet advisory covers CVE-2026-98432.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published
Get an email when Fortinet publishes the next one.
See Fortinet's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Summary
CVSSv3 Score:
9.8
CVE-2026-98432:ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it.
Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice.
Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed.
Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built.
TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build().
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative. Check it before change work.
Official advisory · high-confidence parse· fetched 14 minutes ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists. Confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 14 minutes ago·verify at source
Mitigation checklist
- Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built.
- This will be addressed in a separate patch.
Official advisory · high-confidence parse· fetched 14 minutes ago·verify at source
More Fortinet advisories
- CVE-2026-105481Oct 26, 2026Node2Shell CVEs
- CVE-2026-109618Oct 21, 2026PHP2Shell core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
- CVE-2026-23707Oct 13, 2026FortiAnalyzer Cloud SQL injection
- CVE-2026-23706Oct 13, 2026FortiAnalyzer Cloud SQL injection
- CVE-2026-23705Oct 13, 2026FortiAnalyzer Cloud SQL injection
- CVE-2025-46773Oct 13, 2026FortiAnalyzer Cloud SQL injection
Android app · Google Play
Monitor future Fortinet CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.