CVE-2026-98432: DGN network blocks TCP packets that carry IP Options
CVE-2026-98432 is a critical flaw in the Linux kernel IPv4 TCP handshake. The kernel's own record authority scored it 9.8, Critical, under CVSS 3.1. DGN Teknoloji has enabled an extra filter against this vector on the network of its data center in Bursa.
The flaw runs inside the kernel while a server accepts a TCP connection over IPv4, before any application authentication. If the connecting side's IPv4 header carries IP Options, the kernel stores that field so it can use it in replies. The bug is that the stored field is handed to the new connection without a copy, then freed immediately when the connection closes, while another processor may still be reading it. Reading kernel memory that has already been freed is a use-after-free. The remote side does not need to log in.
Scoring notes on the kernel record say the outcome can be disclosure of kernel heap contents to the remote side, corruption of kernel memory, or a machine crash. Red Hat treats the same record mainly as a crash that interrupts service, or as possible memory corruption, and scores it 8.1. The organization of the Anthropic researcher who reported the flaw says a proof of concept that runs commands was produced in a lab, on Linux servers listening with multipath TCP. That proof of concept has not been published. As of the evening of 29 October 2026, the record was not in CISA's Known Exploited Vulnerabilities catalog.
The record was published on cve.org on 15 October 2026. The upstream fix entered stable releases on 11 and 15 October 2026. According to Atlas's roundup dated 29 October 2026, the fixed versions are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. The bug covers kernels since Linux 4.4 that have not received this fix. Branches that reached upstream end of life before 5.10 have no upstream fix. Distributions carry the patch under their own version numbers. In that same roundup, part of Debian and SUSE Enterprise had shipped the fix, while the kernels tracked by Ubuntu and RHEL 8, 9, and 10 did not yet show one. That table changes. Current status should be checked on the distribution's own security page.
IPv6 connections are not affected by the first issue, according to the fix record. A container uses the kernel of the server it runs on. Refreshing only the container image does not close the flaw. The real close is installing the corrected kernel and rebooting the machine onto that kernel.
The step DGN Teknoloji took is not a kernel patch, and it does not replace the update on a customer's server. Extra security filters are on at the network devices. TCP packets carried over IPv4 that contain an IP Options field are blocked. The aim is to stop a possible exploit at the edge of the network, narrow the attack vector, and keep services running. Notes on the kernel record say the problematic traffic carries IPv4 Record Route or Timestamp options during the handshake. Legitimate TCP traffic almost never uses this IP field.
Normal operation of standard TCP connections is not expected to be affected. MSS, TCP Timestamp, SACK, and Window Scaling are TCP options. The filter does not touch them. It targets only the IP Options field that makes the IPv4 header longer than 20 bytes.
This change is the notice already published in the customer panel, now applied. The filters were enabled to raise the security of the network, reduce the chance that security flaws are exploited, and protect service continuity. Security measures are updated regularly to protect the infrastructure and customer services.
The technical write-up, distribution tables, and sources are in Atlas's article of 29 October 2026.
https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf
The official CVE record is here.
https://www.cve.org/CVERecord?id=CVE-2026-98432
Customers who manage their own server operating system should install the kernel and reboot when their distribution publishes the fix. For IPv4 TCP traffic arriving on the DGN network, the extra filter is a second layer until that update is in place.