ShrineTech
Illustration of a Linux server and a browser window with a patch and reboot symbol, for a kernel and Chrome CVE guide
AnalysisSecurity

Two October CVEs to check this week: the Linux TCP use-after-free and the Chrome sandbox bug on macOS

ShrineTech8 min read
AnalysisSecurity

Two October CVEs to check this week: the Linux TCP use-after-free and the Chrome sandbox bug on macOS

ShrineTech8 min read

In short

CVE-2026-98432 is a use-after-free in the Linux IPv4 TCP stack; Red Hat rates it Critical (9.8) and a public remote-code-execution demonstration exists. Debian and Amazon Linux have fixes, while Ubuntu and Red Hat were still working on theirs when we checked. CVE-2026-106378 is a Chrome sandbox bug on Mac, fixed in Chrome 155. Inventory your kernels, patch, then actually reboot.

Disclosure: this post was drafted with AI assistance and reviewed by ShrineTech. The header image was generated with Krea 2. Defensive guidance only. It contains no exploit details. Facts were checked against the vendor pages listed at the end on 2026-10-31. Vendor status and severity ratings change quickly (several moved during the week), so check your own distro's tracker.

1. CVE-2026-98432: Linux IPv4 TCP use-after-free

What it is. In the Linux IPv4 stack, the IP options saved for a connection request (inet_opt, ireq_opt) were freed with a plain kfree() rather than after an RCU grace period. A retransmitted SYN handled on another CPU, or request-socket migration, could still be reading them, which gives a use-after-free in ip_options_build(). The fix switches the frees to kfree_rcu(). IPv6 is not affected by the main issue. (Sources: NVD, Debian tracker.)

How serious. Treat it as serious. Red Hat rates it Critical (CVSS 3.1 9.8) and says a remote, unauthenticated attacker could trigger code execution, with exploitation needing precise timing. NVD carries a 9.8 from a secondary source and its analysis was still pending ("Received") on 2026-10-30. Ubuntu rates it High (9.8). Other vendors score it lower: Amazon and Oracle list 8.1 (Important). Earlier in the week some vendors rated it lower, so older write-ups may be out of date.

A public demonstration exists. The Go Security Team's notice, forwarded to oss-security on 2026-10-29, refers to an exploit described by Anthropic that achieves remote code execution against a server with an MPTCP listener. The Go team says the demonstrated exploit needs an MPTCP listener, but the bug itself is not MPTCP-specific, so systems without MPTCP listeners may be open to similar attacks. We did not run or test any exploit. As of our check the CVE was not in CISA's KEV catalogue (we did not find it in the portion of the catalogue we read, and NVD showed no KEV fields).

Who is affected. Upstream kernels from 4.4 up to the fixed stable releases: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10 (NVD lists 7.3 as unaffected). Any machine that accepts inbound IPv4 TCP connections is exposed in proportion to who can reach it: public VPS, jump hosts and port-forwarded home servers matter most. A machine behind NAT with no forwarded ports, or a service reachable only through a provider tunnel that terminates TCP, is far less exposed.

Patch status when checked on 2026-10-31.

  • Debian: fixed. bookworm 6.1.190-1 (DLA-4841-1) and linux-6.12 6.12.113-1~deb12u1 (DLA-4850-1), trixie 6.12.113-1 (DSA-6568-1).
  • Ubuntu: the tracker listed no released fix. 22.04, 24.04 and 26.04 showed "vulnerable, work in progress" (in-progress builds 5.15.0-203.213, 6.8.0-149.149 and 7.0.0-43.43). HWE and Raspberry Pi kernels showed vulnerable with no version. Re-check the tracker before you act.
  • Red Hat family: RHEL 8, 9 and 10 and OpenShift are listed as affected (RHSB-2026-016). Red Hat says it is expediting fixes, and the bulletin was still marked "ongoing" on 2026-10-30. Check for errata.
  • Amazon Linux: fixed kernels were published 2026-10-24 to 2026-10-30 (for example ALAS2023-2026-3365 and ALAS2-2026-4065).
  • Oracle Linux: UEK errata ELSA-2026-500397, -500398 and -500399 (2026-10-16). The Oracle page is auto-generated, so confirm on the errata pages.

What to do now

  1. Inventory: uname -r on every Linux machine, VPS and Raspberry Pi, including ones you forgot (a Pi-hole, a jump host).
  2. Check your distro tracker for a fixed kernel: Ubuntu, Debian, Red Hat. Install it as soon as it appears, then reboot. A kernel update does nothing until you boot into it. Check the changelog for the CVE.
  3. Reboot into any already-installed newer kernel only if it is at or above the fixed version for your line.
  4. Reduce exposure while you wait. Close router port-forwards you do not need, and bind internal services to localhost or a VPN address. Disabling MPTCP is a partial stopgap, not a fix: sysctl -w net.mptcp.enabled=0 disables it system-wide (a contributor on oss-security notes running programs may see errors on new connections), and Go programs can set GODEBUG=multipathtcp=0. The Go team calls per-program mitigation fragile and strongly recommends a patched kernel.
  5. Vendor filter (Red Hat, RHSB-2026-016). Red Hat publishes an nftables rule that drops incoming IPv4 TCP packets carrying IP options (ip protocol tcp ip hdrlength > 5). It reduces exposure but cannot fully prevent it. Take the exact rule from the bulletin, test it first, and remove it after the kernel update. We have not tested it ourselves.
  6. Plan reboots deliberately: stop GPU or database jobs first, keep the previous kernel in the boot menu, and do not purge it until the new one has been stable for a few days.

How to verify. uname -r after the reboot shows the fixed version. apt changelog <kernel package> (or rpm -q --changelog kernel) mentions CVE-2026-98432. ss -tln lists only the listeners you expect. If you applied the nft rule, sudo nft list tables shows it until you remove it.

One more note: a social-media post about a loopback-only crash in skb_copy circulated alongside this CVE. We could not tie it to CVE-2026-98432 and none of the pages we read mention it. Treat it as unverified.

2. CVE-2026-106378: Chrome sandbox privilege elevation (Mac)

What it is. The Chrome release notes list it as "Privilege elevation in Sandbox", rated Medium by Chromium, reported by Paulos Yibelo Mesfin. NVD describes it as a sandbox flaw in Chrome on Mac that lets an attacker who has already compromised the renderer process run code outside the sandbox through a crafted HTML page, and gives it CVSS 3.1 8.3 (from a secondary source). In other words it is the second half of a chain: the attacker first needs a separate renderer bug. CISA's SSVC entry on NVD records exploitation as "none" as of 2026-10-06, and the record has no KEV fields.

Public technical write-ups say a compromised GPU process could use the macOS sandbox profile to reach WindowServer and inject keystrokes where the host app has Accessibility permission. We did not verify that detail on a vendor page, so treat it as the researcher's description, not Google's.

Who is affected. Chrome on Mac below 155.0.8059.39. The Chrome Releases post of 2026-10-06 gives the Stable update as 155.0.8059.39/.40 for Windows and Mac and 155.0.8059.39 for Linux. NVD lists the bug as Mac-only. Other Chromium-based browsers pick up the fix on their own schedules, so check each one.

What to do now

  1. Open chrome://settings/help, confirm version 155 or newer, and relaunch.
  2. Look for other Chromium copies: Playwright and Puppeteer browser caches (~/Library/Caches/ms-playwright, ~/.cache/puppeteer), and Electron apps. Delete builds older than 155. Old cached browsers can inherit the Accessibility permission of the Terminal that launched them.
  3. System Settings, Privacy & Security, Accessibility: remove anything that does not need it (terminals, automation tools).
  4. For automation that opens untrusted pages, use the current bundled browser and run it inside a container or a separate low-privilege user. Avoid --no-sandbox where you can.

How to verify. The version in chrome://settings/help. For caches, ls ~/Library/Caches/ms-playwright and run each browser with --version. The Accessibility list shows only what you expect.

Quick answers

Is CVE-2026-98432 being exploited?

A public demonstration exists: the Go Security Team's notice refers to an exploit described by Anthropic that achieves remote code execution against an MPTCP listener. We did not find it in CISA's KEV catalogue when we checked on 2026-10-31.

Does a kernel update fix CVE-2026-98432 straight away?

No. A new kernel does nothing until you reboot into it. After rebooting, uname -r should show a fixed version for your line.

Is IPv6 affected by CVE-2026-98432?

The main issue is in the IPv4 stack. IPv6 is not affected by it, according to the NVD and Debian entries we read.

Which Chrome version fixes CVE-2026-106378?

Chrome 155.0.8059.39 or newer fixes it, per the Chrome Releases post of 2026-10-06. NVD lists the bug as Mac-only. Check other Chromium-based browsers and cached copies too.

Related in this series: hardening your tailnet; the Brotli CVE-2026-111497 patch guide; the egress-audit method.

Sources

Comments (0)

Loading comments...

Back to all posts
© ShrineTech LLC