Veeam patches critical Linux kernel TCP use-after-free CVE-2026-98432 (CVSS 9.8) in backup appliances amid internet-wide MPTCP scanning
Veeam has released kernel updates to fix CVE-2026-98432 (CVSS 9.8, Critical), a use-after-free vulnerability in the Linux kernel's TCP/IPv4 connection setup that ships inside its backup products, which carry a built-in Linux kernel. According to the vendor advisory KB4966, the flaw "can lead to denial of service or memory corruption," and an attacker sending crafted network packets during connection setup can crash or corrupt an unpatched host. Per primary analysis of the underlying kernel bug, it is a race condition in how the kernel frees the IPv4 options attached to an incoming TCP connection; the fix for it was committed upstream on October 5, 2026, published by the Linux kernel CNA as CVE-2026-98432 on October 15, 2026, and a researcher at Anthropic who reported the bug disclosed a remote root exploit against hosts with a multipath TCP (MPTCP) listener on October 27, 2026 (akamai.com). No exploitation of Veeam customers is confirmed and no public RCE exploit has surfaced, but multiple denial-of-service proofs-of-concept are circulating, and security researcher Marcus Hutchins reports internet-wide MPTCP probing of port 443 beginning November 2, 2026 that he suspects is tied to this flaw. Over 450,000 organizations use Veeam to protect their backups, making the exposed attack surface significant.
Entenda a falha
A vulnerabilidade
CVE-2026-98432 (CVSS 9.8) is a use-after-free in the Linux kernel's TCP/IPv4 connection setup, present in Veeam products that bundle a Linux kernel. Affected are Veeam Software Appliance 13.1, Veeam Infrastructure Appliance 13.1, plug-in workers, Linux helper hosts and boot media in Veeam Backup & Replication 13.1 and 12.3, and the AWS, Azure and Google Cloud plug-ins. The bug is in kernels from 4.4 onward. An attacker needs only network reach to a listener, sending crafted packets during the handshake, with no authentication. Veeam's advisory KB4966 says the result is denial of service or memory corruption. The reporter's exploit gives root on hosts with an MPTCP listener. Kasten for Kubernetes images have no kernel and are not affected.
Como funciona
When a SYN packet carrying IP options arrives, the kernel stores those options with the request socket for the pending connection. Since Linux 4.4, request sockets are handled without taking the listener lock. A child socket can therefore be freed while the kernel is still building the SYNACK reply from the same options. The destructor frees the options immediately, and ip_options_build() then reads memory that has already been freed. A lost race only fails the handshake, so it can be retried.
Por que é vulnerável
The root cause is a race condition with a wrong lifetime assumption: the IPv4 options were freed with a plain kfree() even though other code could still read them without the listener lock. The upstream fix by Eric Dumazet replaces kfree() with kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor(). An RCU grace period then passes before the options are freed, so a reader still using them never sees freed memory. The articles do not say why the bug went unnoticed for so long.
Onde está
The flaw is in the Linux kernel IPv4 TCP code: inet_sock_destruct(), tcp_v4_reqsk_destructor() and the read in ip_options_build(). The upstream commit is titled "ipv4: free inet_opt and ireq_opt after an RCU grace period", and one of its stable-branch fix hashes is b3b027ef0cd322bfa839b9aaf5b27551eea54cf6.
Como foi descoberta
According to the story, which cites Akamai's analysis, a researcher at Anthropic reported the bug. The fix was committed upstream on October 5, 2026, and the Linux kernel CNA published the CVE on October 15. On October 27 the researcher disclosed a remote root exploit against hosts with an MPTCP listener. Veeam then published advisory KB4966 and shipped fixes starting November 2. Security researcher Marcus Hutchins reports that residential proxies and Russia-based VPN servers have probed port 443 with MPTCP connections since November 2. He suspects this is tied to the CVE, because standard scanners do not use MPTCP by default. No exploitation of Veeam customers is confirmed.
PoC pública
Multiple denial-of-service proofs-of-concept are circulating, according to the articles, but none is linked in them. The researcher's remote root exploit was described as using the race to leak kernel memory, defeat KASLR and overwrite a callback pointer, but no public RCE exploit has surfaced. Because a lost race only fails the handshake, retries make the attack reliable. With DoS code available and MPTCP probing already seen, patching is urgent for any exposed host.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 13:18.
Detalhes técnicos
The bug sits in the kernel's IPv4 TCP handshake: when a SYN carries IP options, the kernel stores them with the request socket; because request sockets are processed without the listener lock since Linux 4.4, a child socket can be freed while a SYNACK is still being built from the same options, and the destructor frees them with a plain kfree(), so ip_options_build() then reads freed memory (akamai.com). Anthropic reported that its exploit uses the race to leak kernel memory and defeat KASLR, then overwrites a callback pointer to run a command as root; a lost race only fails the handshake, so the attacker can retry until it succeeds (akamai.com). Affected Veeam components are those that bundle a Linux kernel: Veeam Software Appliance 13.1, Veeam Infrastructure Appliance 13.1, plug-in workers, Linux helper hosts and boot media in Veeam Backup & Replication 13.1 and 12.3, and the cloud plug-ins for AWS, Azure and Google Cloud; Veeam Kasten for Kubernetes images contain no Linux kernel and are not affected. Hutchins observed residential proxies and Russia-based VPN servers probing port 443 with MPTCP connections from November 2, 2026; because standard scanners do not use MPTCP by default, he links the activity to this CVE, estimating roughly 2.1 million servers reachable over MPTCP on port 443 (figures that reflect network exposure only, not unpatched kernels).
Detalhes da correção
The upstream fix, authored by Eric Dumazet, replaces kfree() with kfree_rcu() in both the inet_sock_destruct() and tcp_v4_reqsk_destructor() paths so that an RCU grace period elapses before the IPv4 options are freed; it is included in Linux 7.3 and in stable releases 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10 (akamai.com). Veeam has shipped a corresponding fixed kernel for Veeam Software Appliance 13.1 through Veeam Updater since November 2, 2026, with a private fix for Windows-based Veeam Backup & Replication 13.1.2.57 released November 5, 2026 and a private fix for 12.3 to follow (KB4966).
Remediação
- Install the kernel update via Veeam Updater: open the Veeam Host Management console, click Updates, then Install Updates Now, and restart the host if needed.
- For Windows-based Veeam Backup & Replication 13.1.2.57, apply the November 5, 2026 private fix; apply the forthcoming private fix for version 12.3 when available.
- Rebuild virtual labs, replace Azure helper appliances, and update old Linux boot media.
- Where patching is delayed, reduce exposure by disabling MPTCP and TCP request migration (
net.mptcp.enabled=0,net.ipv4.tcp_migrate_req=0); this only reduces the likelihood of triggering the race and is not a substitute for patching (akamai.com).
Linha do tempo
-
Veeam patches critical Linux kernel TCP use-after-free CVE-2026-98432 (CVSS 9.8) in backup appliances amid internet-wide MPTCP scanning
ler a análise desta fonte ocultar
Veeam has released kernel updates to fix CVE-2026-98432 (CVSS 9.8, Critical), a use-after-free vulnerability in the Linux kernel's TCP/IPv4 connection setup that ships inside its backup products, which carry a built-in Linux kernel. According to the vendor advisory KB4966, the flaw "can lead to denial of service or memory corruption," and an attacker sending crafted network packets during connection setup can crash or corrupt an unpatched host. Per primary analysis of the underlying kernel bug, it is a race condition in how the kernel frees the IPv4 options attached to an incoming TCP connection; the fix for it was committed upstream on October 5, 2026, published by the Linux kernel CNA as CVE-2026-98432 on October 15, 2026, and a researcher at Anthropic who reported the bug disclosed a remote root exploit against hosts with a multipath TCP (MPTCP) listener on October 27, 2026 (akamai.com). No exploitation of Veeam customers is confirmed and no public RCE exploit has surfaced, but multiple denial-of-service proofs-of-concept are circulating, and security researcher Marcus Hutchins reports internet-wide MPTCP probing of port 443 beginning November 2, 2026 that he suspects is tied to this flaw. Over 450,000 organizations use Veeam to protect their backups, making the exposed attack surface significant.
Technical Details
The bug sits in the kernel's IPv4 TCP handshake: when a SYN carries IP options, the kernel stores them with the request socket; because request sockets are processed without the listener lock since Linux 4.4, a child socket can be freed while a SYNACK is still being built from the same options, and the destructor frees them with a plain
kfree(), soip_options_build()then reads freed memory (akamai.com). Anthropic reported that its exploit uses the race to leak kernel memory and defeat KASLR, then overwrites a callback pointer to run a command as root; a lost race only fails the handshake, so the attacker can retry until it succeeds (akamai.com). Affected Veeam components are those that bundle a Linux kernel: Veeam Software Appliance 13.1, Veeam Infrastructure Appliance 13.1, plug-in workers, Linux helper hosts and boot media in Veeam Backup & Replication 13.1 and 12.3, and the cloud plug-ins for AWS, Azure and Google Cloud; Veeam Kasten for Kubernetes images contain no Linux kernel and are not affected. Hutchins observed residential proxies and Russia-based VPN servers probing port 443 with MPTCP connections from November 2, 2026; because standard scanners do not use MPTCP by default, he links the activity to this CVE, estimating roughly 2.1 million servers reachable over MPTCP on port 443 (figures that reflect network exposure only, not unpatched kernels).Fix Details
The upstream fix, authored by Eric Dumazet, replaces
kfree()withkfree_rcu()in both theinet_sock_destruct()andtcp_v4_reqsk_destructor()paths so that an RCU grace period elapses before the IPv4 options are freed; it is included in Linux 7.3 and in stable releases 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10 (akamai.com). Veeam has shipped a corresponding fixed kernel for Veeam Software Appliance 13.1 through Veeam Updater since November 2, 2026, with a private fix for Windows-based Veeam Backup & Replication 13.1.2.57 released November 5, 2026 and a private fix for 12.3 to follow (KB4966).Remediation
- Install the kernel update via Veeam Updater: open the Veeam Host Management console, click Updates, then Install Updates Now, and restart the host if needed.
- For Windows-based Veeam Backup & Replication 13.1.2.57, apply the November 5, 2026 private fix; apply the forthcoming private fix for version 12.3 when available.
- Rebuild virtual labs, replace Azure helper appliances, and update old Linux boot media.
- Where patching is delayed, reduce exposure by disabling MPTCP and TCP request migration (
net.mptcp.enabled=0,net.ipv4.tcp_migrate_req=0); this only reduces the likelihood of triggering the race and is not a substitute for patching (akamai.com).