kernel TCP Use-After-Free (CVE-2026-98432)
CVE / CVSS
| CVE | CVSS | EPSS | Vector | Source |
|---|---|---|---|---|
| CVE-2026-98432 (opens in a new tab) Debian (opens in a new tab) | CVSS 9.8 Critical | 0.76 % | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD (v3.1) |
Base scores are looked up from NVD or, if NVD has none yet, the CVE record. Proxmox itself does not publish CVSS scores. “Actively exploited” comes from the CISA KEV catalog, EPSS (probability of exploitation in the next 30 days) from FIRST.
Affected packages
proxmox-kernel-*
Details
A race in IPv4 TCP connection setup can cause a use-after-free. When a retransmitted SYN is handled on another CPU while the new connection's socket is being freed, the kernel may still read that socket's IP options to build a SYN-ACK. A similar race exists with request socket migration (net.ipv4.tcp_migrate_req=1 or a BPF reuseport migrate program). Only SYNs carrying IPv4 options, or CIPSO/NetLabel setups, hit the affected code. The fix frees the options only after an RCU grace period. Native IPv6 is not affected.
Fixed in
proxmox-kernel-7.0.14-25-pve(-signed)
References
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.