Posted by Sultan Alsawaf on Nov 02 Hi Rui, I'm a member of the kernel team at CIQ. I looked into your init_on_free=1 suggestion, and unfortunately it doesn't do anything meaningful against this CVE. The remote KASLR defeat uses pointers leaked from _live_ slab objects via an out-of-bounds read on the freed object.
Re: CVE-2026-98432: init_on_free=1 as an additional interim mitigation
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/476
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations
Introduction As part of proactive threat monitoring, Kaspersky’s Cyber Threat Intelligence team identified a malicious campaign involving C2 agents controlled by…
Alpine Linux rebuilds GitLab after attempted RCE attack
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20-21, prompting the open-source project to rebuild…
CVE-2026-98432: init_on_free=1 as an additional interim mitigation
Posted by Rui Sousa on Oct 31 Hello, An additional hardening option for CVE-2026-98432 (the IPv4 TCP inet_opt use-after-free), for systems that cannot take a fixed…
Attackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539
Drupal warns that attackers are exploiting a critical authorization flaw in Commerce Core, putting vulnerable online stores at risk. Drupal warns that threat actors are…
Drupal security advisory (AV26-1105)
Serial number: AV26-1105 Date: October 30, 2026 As of October 28, 2026, Drupal is affected by a vulnerability in the following product: Commerce Core Versions prior to…
ARTEX and Friends: Enter Agentic Offensive Frameworks
Written by: Aurora Blum, David Mainor, Rohit Nambiar, Omar ElAhdan, Matthew McWhirt, Will Silverstone, Bhavesh Dhake, Chris Busse Introduction Recent intrusions in which…