Cyber ·
CVE-2026-98432: use-after-free in IPv4 TCP and interim mitigation with init_on_free=1
Public notice on CVE-2026-98432, a use-after-free flaw in inet_opt for IPv4 TCP, with interim mitigations discussed on the oss-sec list on 31 October 2026.
On 31 October 2026, Rui Sousa posted to the oss-sec list an additional hardening option for CVE-2026-98432, a use-after-free flaw in inet_opt in IPv4 TCP. The proposal targets systems that cannot yet install a patched kernel and suggests the kernel boot parameter init_on_free=1 as an extra interim mitigation. According to the text, the interim measures published so far, such as the one released by AlmaLinux on 30 October, are an nftables rule that drops inbound TCP traffic carrying IPv4 options and disabling MPTCP. Those measures do not mention init_on_free=1. The original is an automatic translation of the list feed, and the text received is truncated, so it provides no complete assessment of effectiveness or list of affected versions. To consult and verify, find the original notice in the October 2026 oss-sec list using the identifier CVE-2026-98432 and check your Linux distribution vendor's advisory, which lists fixed packages and recommended measures. Do not apply kernel parameters or firewall rules without testing in a controlled environment and confirming the official recommendation.
Original source: CVE-2026-98432: init_on_free=1 como mitigação provisória adicional