CVE-2026-98432: init_on_free=1 as an additional interim mitigation

Summary by Cyber Security News31 Oct 2026, 20:03 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/459

Posted by Rui Sousa on Oct 31 Hello, An additional hardening option for CVE-2026-98432 (the IPv4 TCP inet_opt use-after-free), for systems that cannot take a fixed kernel yet. The interim mitigations published so far (for example AlmaLinux's, at ) are an nftables rule dropping inbound TCP that carries IPv4 options and disabling MPTCP. They do not mention the init_on_free=1 kernel boot parameter

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

Re: Protecting against CVE-2026-98432 when using Go programs

Fwd: Protecting against CVE-2026-98432 when using Go programs

Apache Wicket: 19 CVEs fixed in 8.20.0, 9.25.0 and 10.12.0

Google::Auth for Perl (2 CVEs)

CVE-2026-13575: HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI

Alpine Linux rebuilds GitLab after attempted RCE attack