CVE-2026-98432
CVSS 9.8 CRITICAL: in the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU… EPSS 0.4% (39th percentile). Microsoft patch: Release Notes.
Vulnerabilities & Exploits
The Netherlands’ National Cyber Security Centre (NCSC-NL) reported two fixed Linux kernel IPv4 flaws in an October 30 advisory, including a checksum bug that may let an untrusted guest virtual machine execute code on its host.
The kernel can trust checksum metadata attached to an IPv4 packet without checking that it points to valid data. A malformed packet can therefore make the host kernel handle packet data incorrectly. The second flaw is a race in IPv4 TCP that can cause a use-after-free, potentially leading to memory corruption or system instability.
NCSC-NL says exploitation is complex and large-scale abuse is unlikely given additional distro mitigations. But if a vulnerable host runs untrusted guests, a guest compromise could cross the isolation boundary and affect co-resident workloads. The advisory names affected distribution vendors but provides no per-flaw version details, so it does not establish which kernel builds remain exposed.
1 source · 6h ago
CVSS 9.8 CRITICAL: in the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU… EPSS 0.4% (39th percentile). Microsoft patch: Release Notes.
CVSS 9.3 CRITICAL: in the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing… Microsoft patch: Release Notes.
NCSC-NL Advisories
Kwetsbaarheden verholpen in Linux kernel
Linux heeft kwetsbaarheden verholpen in de IPv4 TCP stack en het IPv4 networking subsystem van de Linux kernel.
originalPart of the PlainSec briefing for 2026-10-30
Every edition of this story: Linux kernel checksum flaw threatens guest isolation