{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","title":"Linux Kernel IPv4 Use-After-Free Vulnerability (CVE-2026-98432)","distribution":{"tlp":{"label":"CLEAR"}},"publisher":{"category":"vendor","name":"WatchGuard PSIRT","namespace":"https://www.watchguard.com"},"tracking":{"id":"WGSA-2026-0033","status":"final","version":"53","initial_release_date":"2026-11-03T22:43:05.005989+00:00","current_release_date":"2026-11-03T22:42:56.723452+00:00","revision_history":[{"date":"2026-11-03T22:43:05.005989+00:00","number":"53","summary":"Initial release."}]},"references":[{"summary":"vendor-advisory","url":"https://psirt.watchguard.com/WGSA-2026-0033"},{"summary":"Reference","url":"https://ubuntu.com/security/CVE-2026-98432"},{"summary":"cve","url":"https://www.cve.org/CVERecord?id=CVE-2026-98432"}],"notes":[{"category":"summary","text":"A use-after-free vulnerability, tracked as CVE-2026-98432, was disclosed in the IPv4 networking code of the Linux kernel. The kernel frees IP option structures right away while other kernel code may still be reading them. That can cause memory corruption when the kernel builds TCP SYN-ACK responses for pending connections, or when it moves pending connections between sockets. Connection migration is used when net.ipv4.tcp_migrate_req=1 is set or a BPF reuseport program is attached. A remote unauthenticated attacker can trigger memory corruption, kernel crash, and potential remote code execution (RCE) by sending specially crafted IPv4 TCP packets.\n\nWatchGuard has investigated and found the following products run a vulnerable version of the Linux Kernel and are potentially affected by CVE-2026-98432:\n- Firebox Fireware OS\n- WatchGuard AP\n- Dimension\n\nWhile Fireware OS and WatchGuard AP run vulnerable versions of the Linux kernel, they do not enable MPTCP and are not affected by the remote code execution (RCE) exploit chain circulating online.\n\nWatchGuard Dimension runs on a vulnerable version of the Ubuntu operating system but without MPTCP enabled. We will update this advisory when a fix is available from Ubuntu.","title":"Summary"}]},"product_tree":{"branches":[{"category":"vendor","name":"WatchGuard","branches":[{"category":"product_name","name":"Fireware OS (Default)","branches":[{"category":"product_version_range","name":"vers >= 12.0; vers 2025.1","product":{"name":"Fireware OS (Default) vers >= 12.0; vers 2025.1","product_id":"CSAFPID-46ae0b14-8bdb-41f9-a57b-563a6e76c5c7-default"}}]},{"category":"product_name","name":"WatchGuard AP","branches":[{"category":"product_version_range","name":"vers >= 1.0","product":{"name":"WatchGuard AP vers >= 1.0","product_id":"CSAFPID-6737224d-68ea-4d9e-80e7-1f38f4c398d8"}}]},{"category":"product_name","name":"Dimension","branches":[{"category":"product_version_range","name":"vers >= 2.0","product":{"name":"Dimension vers >= 2.0","product_id":"CSAFPID-d36d565e-228e-4d9a-888a-9be70889d829"}}]}]}]},"vulnerabilities":[{"notes":[{"category":"description","text":"A use-after-free vulnerability, tracked as CVE-2026-98432, was disclosed in the IPv4 networking code of the Linux kernel. The kernel frees IP option structures right away while other kernel code may still be reading them. That can cause memory corruption when the kernel builds TCP SYN-ACK responses for pending connections, or when it moves pending connections between sockets. Connection migration is used when net.ipv4.tcp_migrate_req=1 is set or a BPF reuseport program is attached. A remote unauthenticated attacker can trigger memory corruption, kernel crash, and potential remote code execution (RCE) by sending specially crafted IPv4 TCP packets.\n\nWatchGuard has investigated and found the following products run a vulnerable version of the Linux Kernel and are potentially affected by CVE-2026-98432:\n- Firebox Fireware OS\n- WatchGuard AP\n- Dimension\n\nWhile Fireware OS and WatchGuard AP run vulnerable versions of the Linux kernel, they do not enable MPTCP and are not affected by the remote code execution (RCE) exploit chain circulating online.\n\nWatchGuard Dimension runs on a vulnerable version of the Ubuntu operating system but without MPTCP enabled. We will update this advisory when a fix is available from Ubuntu.","title":"Summary"}],"product_status":{"known_affected":["CSAFPID-46ae0b14-8bdb-41f9-a57b-563a6e76c5c7-default","CSAFPID-6737224d-68ea-4d9e-80e7-1f38f4c398d8","CSAFPID-d36d565e-228e-4d9a-888a-9be70889d829"]},"cve":"CVE-2026-98432"}]}