Linux yadrosida aniqlangan CVE-2026-98432 nomli muhim zaiflik Ubuntu tizimlariga tarmoq xotirasi bilan bog'liq nuqson orqali tahdid soladi, bu esa tizimning ishdan chiqishi va xizmatlar to'xtashiga olib kelishi mumkin.
Ubuntu 2026-yil 15-oktabrda maslahat e'lon qildi va 29-oktabrda yangilanish taqdim etdi. Zaiflikka CVSS jiddiylik bahosi 9,8 berilgan, bu esa tuzatishning yuqori ustuvorligini bildiradi.
Ubuntu xavfsizlik maslahati IPv4 TCP ulanishlarini boshqarishda use-after-free zaifligini tasvirlaydi. Garchi bu nuqson tizimni ishdan chiqarishi mumkin bo'lsa-da, e'lon qilingan tavsifda ishonchli masofaviy ekspluatatsiya yoki faol foydalanish tasdiqlanmagan.
Zaiflik tcpv4synrecvsock() funksiyasida yuzaga keladi, u IP opsiyalarini so'rov soketining ireq->ireq_opt ko'rsatkichidan yangi yaratilgan bola soketiga asosiy ma'lumotlarni nusxalamasdan o'tkazadi.
Shu bilan birga, boshqa protsessor shu so'rov uchun qayta yuborilgan SYN paketini qayta ishlashi va tcpcheckreq() orqali SYNACK javobini tuzishi mumkin. tcpv4sendsynack() va inetcskroutereq() kabi funksiyalar ushbu umumiy opsiyalarga RCU o'qish qulfi ostida murojaat qiladi.
Muammo bola soket SYNACK tuzilishi tugamasdan oldin yo'q qilinganda yuzaga keladi. Chunki inetsockdestruct() inetopt ni oddiy kfree() yordamida ozod qiladi, bir vaqtda ishlovchi o'quvchilar ipoptions_build() ichida ozod qilingan xotiraga murojaat qilishlari mumkin. So'rov soketlari commit 079096f103fa dan beri tinglovchi qulfsiz ishlaydi, bu esa xavfli bir-biriga mos kelishni ta'minlaydi.
Bog'liq poyga (race) so'rov soketining ko'chirilishiga ham ta'sir qiladi, agar net.ipv4.tcpmigratereq=1 yoki BPFSKREUSEPORTSELECTORMIGRATE dasturi ishlatilsa. Klonlangan so'rov soketlari vaqtincha ireqopt ni ulashadi, bu esa bir protsessor boshqa protsessor klonni ozod qilgandan keyin ham opsiyalarni o'qishni davom ettirishiga imkon beradi.
Tuzatish inetsockdestruct() va tcpv4reqskdestructor() da darhol ozod qilishni kfreercu() bilan almashtiradi. Bu xotirani qayta ishlatishni mavjud RCU o'quvchilari tugaguncha kechiktiradi va umr davrining mos kelmasligini bartaraf etadi. Shunga o'xshash sinxronizatsiya xatolari Linux yadrosining boshqa RCU xotira xavfsizligi tadqiqotlarida ham uchragan.
Ubuntu kuzatuvchisi 26.10, 26.04 LTS, 24.04 LTS va 22.04 LTS relizlari uchun umumiy yadrolarni zaif deb ro'yxatga olgan, tuzatishlar jarayonda. Ro'yxatdagi maqsadli tuzilmalar e'lon qilingan xavfsizlik yangilanishlari bilan adashtirilmasligi kerak. Eski relizlar va bir nechta bulut yadrosi variantlari ham zaif deb ko'rsatilgan.
SOCingizga tezkor hodisalarni to'xtatish uchun ogohlantirish kontekstini bering. 16K SOCdan tahdid razvedkasini integratsiya qiling.
A critical vulnerability in the Linux kernel, identified as CVE-2026-98432, threatens Ubuntu systemsthrough a networking memory flaw that could cause crashes and service disruptions.
Ubuntu released an advisory on October 15, 2026, and provided an update on October 29. The vulnerability has been assigned a CVSS severity score of 9.8, indicating a high priority for remediation.
The Ubuntu security advisory describes a use-after-free vulnerability in IPv4 TCP connection handling. Although the defect can cause a crash, the published description does not describe a reliable remote exploit or confirm active exploitation.
The vulnerability originates in tcpv4synrecvsock(), which transfers ownership of IP options from a request socket’s ireq->ireq_opt pointer to a newly created child socket without copying the underlying data.
Meanwhile, another processor can handle a retransmitted SYN packet for the same request and build a SYNACK response through tcpcheckreq(). Functions including tcpv4sendsynack() and inetcskroutereq() access those shared options under an RCU read lock.
The problem emerges when the child socket is destroyed before SYNACK construction finishes. Because inetsockdestruct() releases inetopt using ordinary kfree(), concurrent readers can access freed memory inside ipoptions_build(). Request sockets have operated without the listener lock since commit 079096f103fa, enabling this dangerous overlap.
A related race affects request socket migration when net.ipv4.tcpmigratereq=1 or a BPFSKREUSEPORTSELECTORMIGRATE program is used. Cloned request sockets temporarily share ireqopt, allowing one processor to continue reading options after another frees the clone.
The correction replaces immediate deallocation with kfreercu() in inetsockdestruct() and tcpv4reqskdestructor(). This defers memory reclamation until existing RCU readers finish, addressing the lifetime mismatch. Similar synchronization failures have featured in other Linux kernel RCU memory-safety research.
Ubuntu’s tracker lists the generic kernels for releases 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS as vulnerable, with fixes in progress. Listed target builds must not be mistaken for released security updates. Older releases and multiple cloud kernel variants also appear as vulnerable.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.
