Yet another Hacker News

TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8

140 points oger 2 hours ago 67 comments

oger 2 hours ago | parent

MikroTik routers seem affected but mitigations are available.

Watch your Linux systems for kernel updates. Reboot!

tgv 1 hour ago | parent

If you use sysctl to disable mptcp, you need to do that again after each reboot.

voidfunc 1 hour ago | parent

Oh joy.

mrob 1 hour ago | parent

>the kernel handed those saved options from the request socket to the new connection without copying them, then freed them immediately when the connection went away, while another CPU could still be reading them to build a handshake reply.

If this requires a multi-core system to exploit, it's good news for most of the consumer routers that will never get updates. Saved by cheap single-core hardware.

dist-epoch 1 hour ago | parent

Those routers probably have 20 other critical un-patched exploits ...

An entire ecosystem of malware crawling and cohabiting in them.

microtonal 1 hour ago | parent

You would be surprised. A lot of cheap consumer routers are have two or four ARM cores. The bigger issue is that they are typically running a kernel from the stone age (< 6.0.0). Sometimes a still-supported LTS kernel like 5.10 or 5.15, but then they stopped at an old patch level.

Heck, apparently even the new Unifi UCG Fiber is running 5.4.213 (September 2022), but maybe they backport some fixes?

[1] https://community.ui.com/releases/dd0283dc-bf71-4140-ae1d-c1...

wiskinator 1 hour ago | parent

> Anthropic says Claude wrote the exploit "after initial prompting," that it runs "arbitrary commands as root, without any credentials or user interaction" on servers with a multipath TCP listener, and that in its proof of concept "it takes 48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution."

This is wild. I'm a firmware nerd, not a backend nerd, what percentage of TCP/IP servers are 'multipath'?

Also, since IPv6 isn't affected, wouldn't it be funny if this is what it took to get everyone to switch.

dist-epoch 1 hour ago | parent

My understanding is that an app explicitly needs to open a "multipath" socket. Go 1.24 does that by default, so does Caddy, these would be the big ones.

grey-area 1 hour ago | parent

Your understanding seems to be wrong.

Every Ubuntu version in the last decade is currently vulnerable.

https://ubuntu.com/security/CVE-2026-98432

Patches not yet available. That makes this a big deal.

This article says that this isn’t app level but is level and can be exploited before requests reach apps.

dist-epoch 1 hour ago | parent

> on servers with a multipath TCP listener

I was talking about the Anthropic blog post, only Go/Caddy enable multipath TCP listeners by default.

grey-area 1 hour ago | parent

Well somebody is wrong, this blog post says:

Why it's urgent: the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection.

It reads like it was LLM generated though so who knows. There is at least a simple mitigation for Golang apps if that is the only concern.

dist-epoch 1 hour ago | parent

Both are correct :)

Anthropic only exploited multipath TCP, but the bug is deeper and also affects TCP connections, but it looks like this path is harder to exploit, and it's unclear if anybody managed to.

grey-area 1 hour ago | parent

Thanks. Expanding exploits is something LLMs seem pretty good at so I’d expect people to manage a more general exploit soon if not already. Hopefully it’ll be patched before that happens.

cataflam 1 hour ago | parent

> what percentage of TCP/IP servers are 'multipath'?

no idea, but at least Tailscale and Caddy were opening MPTCP sockets on servers I checked.

theteapot 1 hour ago | parent

What is a "multipath TCP listener"?

dist-epoch 1 hour ago | parent

You have a Wifi network interface and a wired Ethernet one, multipath is somehow combining the two together.

sweetjuly 1 hour ago | parent

In addition to aggregating, it can also be useful in cases where one link is much slower or higher latency. For example, if you're sitting in your driveway trying to get directions in maps while your phone is still on your very weak wifi network, it's a better user experience to have it to attempt the request using both radios concurrently so that it can fallback to cellular without waiting for a timeout/connection error if you're too far for wifi to actually work well.

cowlevel 16 minutes ago | parent

Do apps actually use this possibility though?

Noxwizard 1 hour ago | parent

I had to look it up too since I hadn't heard of it. It's an extension to TCP that allows responses across different NICs. Sort of like Link Aggregation on to a switch, except it can go out dissimilar interfaces, like your wifi connection and your hardwired connection. Looks like you have to opt into it when you set up your socket: https://docs.kernel.org/networking/mptcp.html

wahern 1 hour ago | parent

See https://en.wikipedia.org/wiki/Multipath_TCP

It's an extension to TCP that, similar to QUIC, allows you to use multiple address/port pairs to transmit data over a single logical stream. Both client/initiator and server/listener have to opt into the extension. This might need to be enabled explicitly by the application[1], which Go apparently does for you, or judging from other posts may be enabled by default systemwide, depending on your platform.

AFAIU, a major user of MPTCP is Apple and the iPhone, and the ubiquity of iPhone clients motivated implementation in and deployment on Linux servers.

[1] https://docs.kernel.org/networking/mptcp.html#sockets-api

jacquesm 46 minutes ago | parent

A listener is a piece of software that advertises itself as available to inbound connections. You can do this on a variety of protocols.

Multipath TCP is a neat trick that allows a single TCP connection (TCP = Transport Control Protocol, a stateless protocol for long running connections) to use multiple physical interfaces. You could do something similar before MTCP using bonding, but this was annoying to set up and usually required application level code to efficiently use the bonded connection. MTCP makes this much simpler from an application level point of view and it can use widely diverse underlying transport layers at the same time (for instance, WiFi, Cellular and wired connections).

swinglock 1 hour ago | parent

How are Ubuntu and RHEL not fixed? Few operating systems market themselves more as suitable for servers. What are they doing over there?

Shank 1 hour ago | parent

I’m pretty confused because apparently Anthropic is the group that followed “responsible disclosure” but apparently even though upstream was patched a couple weeks ago, still nothing on either.

lakeviewterrace 52 minutes ago | parent

Running regression tests I assume; they can't just YOLO shit like most OSS projects for the exact reason you mention.

swinglock 49 minutes ago | parent

For a month?

Flockster 46 minutes ago | parent

Going by the proxmox forum the fix is already in the sources (proxmox released their kernel based on them a few days ago). But I could not see, if it is already released for the users.

https://forum.proxmox.com/threads/cve-2026-98432-in-proxmox-...

tlamponi 36 minutes ago | parent

Yes, we (Proxmox) included the fix for this in 7.0.14-25, which was initially packaged two weeks ago.

It went through internal QA and to the test soon after that, then a few days later to the no-subscription repository and as of yesterday morning CET it was cleared for the enterprise one, so it's available on all repos of all Products we got in their current supported releases.

For kernel updates we where even more conservative in the past, but with the current churn on often quite relevant fixes picked up the pace a bit on moving them along, trying still to balance rolling out fixes fast(er) while not doing that so fast that tricky (hardware/setup specific) regressions don't get caught.

edit: As this makes the rounds we also released a PSA for it now [0] to make our status here easier to find.

[0]: https://forum.proxmox.com/threads/proxmox-virtual-environmen...

kev009 1 minute ago | parent

If you read commit logs of, say kernel.org and a distro kernel, and aren't concerned you are blissfully ignorant (and it is worse for the broader userland repos). The kernel orgs are pretty lean and this has been the status quo for decades. CVEs of sufficient stature like this will get fixed but majority of other issues slip by unnoticed. LTS is kind of a myth, it trades ABI and API stability for a lot of other issues.

Shank 1 hour ago | parent

At least if you’re on Amazon Web Services behind a load balancer you probably aren’t really that impacted enough to spend Halloween patching.

> AWS Web Application Firewall, Application Load Balancer, Classic Load Balancer, TLS Listeners on Network Load Balancer, Cloud Front, API Gateway

> Customers using the above services do not receive TCP connections from untrusted sources directly when following best practices. AWS is applying updates to the underlying infrastructure of these services and no immediate customer action is required if you are using these services. We still recommend customers update their self-managed instances behind these services within the next 30 days.

[0]: https://aws.amazon.com/security/security-bulletins/2026-160-...

sebmellen 1 hour ago | parent

Another reason hyperscaler cloud providers will continue to grow (IMO)!

gwbas1c 1 hour ago | parent

I'm more worried about my consumer-grade router.

wtch98 24 minutes ago | parent

I blocked packets arriving externally on my firewall with ip-options a couple of days ago. Firewall rule has zero hits, and I've got a very open ISP (andrews+arnold), if I want I can host SMTP, DNS, whatever

daemonologist 1 hour ago | parent

Some previous discussion: https://news.ycombinator.com/item?id=50299182

ogogmad 1 hour ago | parent

How are people finding Fil-C? It's designed to avoid things like this.

cowlevel 15 minutes ago | parent

Does it support writing kernels?

_flux 8 minutes ago | parent

It might be bit of an effort to get Fil-C compiling the Linux kernel. As I understand it, it would amount to running garbage collector in the kernel, so some care would probably need to be taken to ensure it doesn't stop things at the wrong time, e.g. interrupts.

jmclnx 1 hour ago | parent

If I am reading this right, Slackware 15.0 is already fixed:

     % uname -a
     Linux XXXX 5.15.223 #1 SMP PREEMPT Thu Oct 22 00:03:07 CDT 2026
     x86_64 Intel(R) Core(TM) i7-4810MQ CPU @ 2.80GHz GenuineIntel GNU/Linux

api 1 hour ago | parent

2027 is going to be the year of two to three major CVEs per day.

The discourse on this is weird, sounds at times as if these are “because of AI.” These are mostly pre-existing bugs, some very old, and they’ve been lurking. If they all get found we exit the other side more secure and reliable.

grey-area 1 hour ago | parent

No patches for Ubuntu or red hat yet.

https://ubuntu.com/security/CVE-2026-98432

https://access.redhat.com/security/cve/cve-2026-98432

AdrianCX 57 minutes ago | parent

so just block multipath and add the firewall rule from article that drops packets with IPv4 options

grey-area 54 minutes ago | parent

Hoping fix will be out soon so we don’t have to.

stefangordon 33 minutes ago | parent

Both of which we are finding out are apparently insufficient to mitigate this.

peanut-walrus 1 hour ago | parent

Some notes I've got about this:

- MPTCP is not a requirement, it is a generic use-after-free.

- Exploitability over the internet is unlikely, most ISP routers drop packets with ipoptions fields.

- At least according to Red Hat, dropping packets with ipoptions yourself helps, but is not a full mitigation.

- Successful exploit requires multiple CPU cores to process packets, so systems with just a single core or packet processing pinned to a single core are not affected.

wahern 54 minutes ago | parent

> Exploitability over the internet is unlikely, most ISP routers drop packets with ipoptions fields.

That doesn't track. Apple iPhones are a major user of MPTCP and they report the majority of requests supporting MPTCP, IIRC 70+%.

peanut-walrus 50 minutes ago | parent

MPTCP uses TCP options fields, the vulnerability is in IP options.

tptacek 15 minutes ago | parent

Dropping packets with IP options from XDP should be a more complete mitigation (also more performant).

gadtfly 58 minutes ago | parent

Everything talks about this in terms of servers, but what about desktop Linux in typical setups? Consumer modems and routers? IoT junk?

rwmj 33 minutes ago | parent

IoT devices will get fixes delivered on the 12th of never.

gadtfly 31 minutes ago | parent

But are they exploitably vulnerable to this specifically in typical setups?

rwmj 27 minutes ago | parent

To be fair probably not as many will be single core and this requires multi-core. As for the thousands of other CVEs though ...

RedShift1 3 minutes ago | parent

The security fixed will be installed next tuesday.

eterm 30 minutes ago | parent

You should assume your IoT junk is already compromised, that's why your IoT junk runs on a dedicated VLAN.

gadtfly 27 minutes ago | parent

Desktop Linux in typical setups? Consumer modems and routers?

marcosscriven 58 minutes ago | parent

Can anyone explain how user after free results in a practical exploit?

I ask because I’ve been dabbling in rooting various closed devices at home. I’m finding AI fantastic at finding vulnerabilities statically (from firmware upgrade binaries), but when you then ask it to use it to get root or code execution it just goes in circles.

In the end it usually ends up there’s no exploit it can find, because it can’t actually influence the affected memory in a useful way. This is especially so if that memory is in the heap. On the stack it’s a lot more predictable (especially with OOB writes).

kstrauser 54 minutes ago | parent

One example is that you might be able to read what was written there. Here that may mean you could read another process’s packet(s). Imagine they were sending unencrypted passwords, perhaps because it’s in a trusted LAN connection.

fguerraz 27 minutes ago | parent

If it’s freed it can be reallocated, so then you have pointers to the same area of memory used for completely different data structures, and this can go very wrong

marcosscriven 22 minutes ago | parent

I get the principle - what I struggle to find is concrete examples of how it can practically be used.

How do you know which pointer (as I say, especially if it’s in the heap)? And I know it can go wrong - but how do you do more than just crash the kernel?

In OOB writes in a stack variable it’s completely clear to me. For other situations I’d love to find real and clearly explained exploits of past UAF or OOB vulnerabilities.

cowlevel 21 minutes ago | parent

Getting the right thing allocated in the right place to exploit a UAF is usually very very tricky. For a defender we just need to know it's probably possible and therefore we patch the bug, but the attacker still has a difficult job to do even already knowing a UAF bug.

The simplest thing you could try to do is allocate several more of the same type of object and hope one of them lands at the same memory address. For example if you can UAF a web app's user session and keep it open for a long time period (not true in the TCP bug), you might try to wait until an admin happens to log in with their session at the same address, then use their admin session.

Or you can allocate a lot of something else objects and hope a certain field overlaps, like a function pointer if you can write to it. Like suppose you can get some kind of authentication callback pointer to overlap where your packet sequence number was, maybe you can send a certain number of packets to make it point to the return instruction and skip the authentication.

lakeviewterrace 48 minutes ago | parent

Is OpenWRT affected? Because that would be a real fawkin problem.

ronnier 42 minutes ago | parent

As much as I hate to link to this site, this particular sub is very good:

https://www.reddit.com/r/openwrt/comments/1xka85h/is_the_ope...

They say 25.12-SNAPSHOT has it fixed

lunar_rover 39 minutes ago | parent

OpenWrt doesn't open ports by default so I think the impact is minimal, unless this can breach nftables as well. CGNAT also mitigates this as a side effect.

If you have services open on the IPv4 net however, close them immediately as a precaution.

bana-io 36 minutes ago | parent

Without a test-case, read POC, how do I verify if my server is affected?

lakeviewterrace 31 minutes ago | parent

The linked source spun up my fans with 100% GPU utilization. Is there some... unwelcome... script running?

rurban 25 minutes ago | parent

In an earlier report, it said only affected is kernel 4.4, not all since. This quite dramatic now.

I see. https://nvd.nist.gov/vuln/detail/cve-2026-98432 affected versions format is the culprit. Entirely unusable. We do have versions, branch names and tags for a reason.

pizza234 19 minutes ago | parent

Wrong. Every kernel from 4.4 onward is affected until the fixed releases (5.10.272, 5.15.223, 6.1.190 and so on).

geye1234 25 minutes ago | parent

My home firewall runs Ubuntu. It doesn't accept (new) incoming packets from the internet. I don't have any IoT devices except printers, whose packets the firewall rejects, and has done since I bought them. Do I need to do anything apart from wait for the patch to become available?