CVE-2026-98432: MikroTik RouterOS: memory handling vulnerability has been identified in the Linux kernel that RouterOS 7 is built on

A memory handling vulnerability has been identified in the Linux kernel that RouterOS 7 is built on. The vulnerability can affect devices reachable from untrusted networks.

RouterOS devices by default are protected from the internet side. The issue is in how IPv4 TCP connections that carry optional IP settings are handled.

In a specific timing case during connection setup, a small amount of memory can be released while it is still in use. In most situations this has no noticeable effect; in the worst case it may make the router unstable or cause it to restart.

This is a Linux kernel vulnerability, assigned CVE-2026-98432. IPv6 connections are not affected.

Who is affected: RouterOS 7 devices that have not been updated to a release containing the fix. The issue is triggered by traffic sent to a TCP service running on the router itself, not by traffic that is simply routed through it.

In the default configuration, the firewall drops unsolicited traffic arriving from the internet, so a router with the default firewall cannot be reached this way from the WAN. The risk is higher if management or other TCP services on the router have been opened to untrusted networks, or if the firewall has been disabled or replaced with permissive rules.

Affected product named by the advisory: MikroTik RouterOS.