EN PT-BR
← Voltar ao feed
medium

Fortinet PSIRT advisory FG-IR-26-188 describes Linux kernel IPv4 TCP use-after-free (CVE-2026-98432)

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 05:00 · coletado há 1 hora

Fortinet PSIRT published advisory FG-IR-26-188 on 2026-11-02 for CVE-2026-98432, a use-after-free in the Linux kernel IPv4 TCP stack (inet_opt / ireq_opt handling). The article does not specify which Fortinet products are affected. It does not state active exploitation, a CVSS score, fixed versions or attribution. IPv6 is not affected by the first issue, and the IPv6 migration variant tied to CALIPSO will be fixed in a separate patch.

Entenda a falha

A vulnerabilidade

CVE-2026-98432 is a use-after-free in the Linux kernel IPv4 TCP stack, in the handling of inet_opt / ireq_opt (IP options of request and child sockets). It is reachable through normal TCP handshake traffic: a retransmitted SYN processed on another CPU while the child socket is being freed. The articles give no CVSS score, no attacker prerequisites beyond this race, no affected or fixed versions, and no report of exploitation. Fortinet's advisory FG-IR-26-188 lists many Fortinet products but does not say which are affected. IPv6 is not affected by the first issue.

Como funciona

When the handshake completes, tcp_v4_syn_recv_sock() hands ireq->ireq_opt to the new child socket (as inet_opt) without copying it. If the client retransmits its SYN, another CPU can handle it for the same request socket and send a SYNACK from tcp_check_req(). That path (tcp_v4_send_synack(), inet_csk_route_req()) reads ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() / ip_options_build() read opt->optlen twice. Meanwhile the child can be destroyed and its options freed, so the SYNACK builder reads freed memory. A similar race exists with request socket migration, where the old and cloned request sockets share ireq_opt.

Por que é vulnerável

Since commit 079096f103fa, request sockets are processed without the listener lock, so nothing stops the child from being freed while a SYNACK is still being built. TCP child sockets lack SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree() even though readers rely on RCU. In migration (net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program), reqsk_timer_handler() clones the request socket via inet_reqsk_clone(), and tcp_v4_reqsk_destructor() also uses a plain kfree(). The fix uses kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor(), as other paths that replace inet_opt already do.

Onde está

Linux kernel IPv4 TCP: tcp_v4_syn_recv_sock(), tcp_check_req(), tcp_v4_send_synack(), inet_csk_route_req(), ip_build_and_send_pkt(), ip_options_build(), reqsk_timer_handler(), inet_sock_destruct() and tcp_v4_reqsk_destructor(); the race was introduced by commit 079096f103fa.

Como foi descoberta

The articles do not say who found the flaw or how. Fortinet PSIRT published advisory FG-IR-26-188 on 2026-11-02 (initial publication), with the description matching a kernel patch. The IPv6 variant tied to CALIPSO (ipv6_opt in tcp_v6_reqsk_destructor()) will be handled in a separate patch.

Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 14:19.

Detalhes técnicos

  • tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket without copying it. Another CPU can concurrently handle a retransmitted SYN for the same request socket and send a SYNACK from tcp_check_req().
  • tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() / ip_options_build() read opt->optlen twice.
  • Since commit 079096f103fa, request sockets are processed without the listener lock, so the child socket can be freed while the SYNACK is still being built. TCP child sockets lack SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), causing a use-after-free in ip_options_build().
  • A similar issue exists with request socket migration (net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler() clones the request socket via inet_reqsk_clone(), so the old and cloned sockets share ireq_opt, and tcp_v4_reqsk_destructor() also uses a plain kfree().
  • The fix described uses kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor(), consistent with other paths that replace inet_opt.

Remediação

The article gives no fixed versions and does not specify which Fortinet products are affected. Defenders should consult the FG-IR-26-188 advisory for affected products and apply the fix described (kfree_rcu() in the two destructors) once it is available in their kernel.

Linha do tempo

  1. fortiguard.fortinet.com ↗ · pub. 02/11/2026 05:00 · coletado 02/11 14:01 primeiro registro

    Fortinet PSIRT advisory FG-IR-26-188 describes Linux kernel IPv4 TCP use-after-free (CVE-2026-98432)

    ler a análise desta fonte

    Fortinet PSIRT published advisory FG-IR-26-188 on 2026-11-02 for CVE-2026-98432, a use-after-free in the Linux kernel IPv4 TCP stack (inet_opt / ireq_opt handling). The article does not specify which Fortinet products are affected. It does not state active exploitation, a CVSS score, fixed versions or attribution. IPv6 is not affected by the first issue, and the IPv6 migration variant tied to CALIPSO will be fixed in a separate patch.

    Technical Details

    • tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket without copying it. Another CPU can concurrently handle a retransmitted SYN for the same request socket and send a SYNACK from tcp_check_req().
    • tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() / ip_options_build() read opt->optlen twice.
    • Since commit 079096f103fa, request sockets are processed without the listener lock, so the child socket can be freed while the SYNACK is still being built. TCP child sockets lack SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), causing a use-after-free in ip_options_build().
    • A similar issue exists with request socket migration (net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler() clones the request socket via inet_reqsk_clone(), so the old and cloned sockets share ireq_opt, and tcp_v4_reqsk_destructor() also uses a plain kfree().
    • The fix described uses kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor(), consistent with other paths that replace inet_opt.

    Remediation

    The article gives no fixed versions and does not specify which Fortinet products are affected. Defenders should consult the FG-IR-26-188 advisory for affected products and apply the fix described (kfree_rcu() in the two destructors) once it is available in their kernel.