{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "CVE-2026-98432 is a use-after-free in the Linux kernel during IPv4 TCP connection setup. An attacker on the network can trigger the bug without credentials. On 2026-10-29, the Go security team reported a demonstrated attack that ran code remotely through this bug. The attack used Multipath TCP (MPTCP) connections, which programs built with Go 1.24 or later accept by default. Gravwell builds current releases with Go 1.26.\n\nSelf-Hosted customers must install the kernel update from the vendor of their operating system, then reboot each host. No action required from users of Gravwell Cloud services. Gravwell continues to investigate the impact on Gravwell components. When the investigation ends, Gravwell will update this advisory.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Do these steps on each Linux host that runs Gravwell services or ingesters:\n\n1. Install the kernel update for CVE-2026-98432 from the vendor of your operating system. On Debian 13, the fixed version is linux 6.12.113-1.\n2. Reboot the host. The fixed kernel runs only after a reboot.\n3. Make sure that uname -r shows the fixed kernel version.\n\nIf you run Gravwell in Docker, do these steps on the Docker host. Containers use the kernel of their host.",
        "title": "Self-Hosted"
      },
      {
        "category": "general",
        "text": "No action required from users of Gravwell Cloud services.\n\nIf you run edge-deployed ingesters or federators on your own hosts, do the Self-Hosted steps on those hosts.",
        "title": "Gravwell Cloud"
      },
      {
        "category": "legal_disclaimer",
        "text": "This advisory is provided as is. Scores are Gravwell's assessment of each vulnerability as it affects Gravwell.",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@gravwell.io",
      "name": "Gravwell",
      "namespace": "https://gravwell.io"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.gravwell.io/.well-known/csaf/white/2026/gvd-2026-0003.json"
      },
      {
        "category": "self",
        "summary": "Human-readable advisory",
        "url": "https://security.gravwell.io/advisories/GVD-2026-0003/"
      }
    ],
    "title": "Use-after-free in the Linux kernel during IPv4 TCP connection setup",
    "tracking": {
      "current_release_date": "2026-10-30T00:00:00.000Z",
      "generator": {
        "engine": {
          "name": "gvd"
        }
      },
      "id": "GVD-2026-0003",
      "initial_release_date": "2026-10-30T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-10-30T00:00:00.000Z",
          "number": "1",
          "summary": "Initial publication while Gravwell investigates."
        }
      ],
      "status": "interim",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:semver/*",
                "product": {
                  "name": "Gravwell (all versions)",
                  "product_id": "GRAVWELL-ALL"
                }
              }
            ],
            "category": "product_name",
            "name": "Gravwell"
          }
        ],
        "category": "vendor",
        "name": "Gravwell"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-98432",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "CVE-2026-98432 is a use-after-free in the Linux kernel during IPv4 TCP connection setup. An attacker on the network can trigger the bug without credentials. It affects kernels from 4.4 up to the stable releases that contain the fix. Debian 13 fixes it in linux 6.12.113-1.\n\nOn 2026-10-29, the Go security team reported a demonstrated attack that ran code remotely through this bug. The attack used Multipath TCP (MPTCP) connections. Programs built with Go 1.24 or later accept MPTCP connections by default. The Go team states that the bug is not specific to MPTCP. A kernel update is necessary to fix it.",
          "title": "Description"
        },
        {
          "category": "details",
          "text": "The Linux kernel on hosts that run Gravwell services or ingesters",
          "title": "Affected component"
        },
        {
          "category": "other",
          "text": "CVSS 4.0 base score 9.3 (Critical), CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSS 4.0"
        }
      ],
      "product_status": {
        "under_investigation": [
          "GRAVWELL-ALL"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE record: CVE-2026-98432",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-98432"
        },
        {
          "category": "external",
          "summary": "NVD: CVE-2026-98432",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98432"
        },
        {
          "category": "external",
          "summary": "Debian security tracker: CVE-2026-98432",
          "url": "https://security-tracker.debian.org/tracker/CVE-2026-98432"
        },
        {
          "category": "external",
          "summary": "oss-security: Go announcement of the MPTCP exploit",
          "url": "https://www.openwall.com/lists/oss-security/2026/10/30/1"
        },
        {
          "category": "external",
          "summary": "Go Issue #82717",
          "url": "https://go.dev/issue/82717"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "GRAVWELL-ALL"
          ]
        }
      ],
      "title": "Use-after-free in the Linux kernel during IPv4 TCP connection setup"
    }
  ]
}