# GSA-2026-0003: Use-after-free in the Linux kernel during IPv4 TCP connection setup

| | |
|---|---|
| Advisory | GSA-2026-0003 |
| Kind | Third Party |
| Severity | Critical |
| Published | 2026-10-30 |
| Last updated | 2026-10-30 |
| Fixed in | None yet |
| CSAF | https://security.gravwell.io/.well-known/csaf/white/2026/gsa-2026-0003.json |
| Web page | https://security.gravwell.io/advisories/GSA-2026-0003/ |

## What you need to do

### Self-Hosted

Do these steps on each Linux host that runs Gravwell services or ingesters:

1. Install the kernel update for CVE-2026-98432 from the vendor of your operating system. On Debian 13, the fixed
   version is `linux` 6.12.113-1.
2. Reboot the host. The fixed kernel runs only after a reboot.
3. Make sure that `uname -r` shows the fixed kernel version.

If you run Gravwell in Docker, do these steps on the Docker host. Containers use the kernel of their host.

### Gravwell Cloud

No action required from users of Gravwell Cloud services.

If you run edge-deployed ingesters or federators on your own hosts, do the Self-Hosted steps on those hosts.

## Vulnerabilities

| Identifier | Severity | CVSS 4.0 | CWE | Status | Fixed in |
|---|---|---|---|---|---|
| CVE-2026-98432 | Critical | 9.3 | CWE-416 | Affected | - |

### CVE-2026-98432: Use-after-free in the Linux kernel during IPv4 TCP connection setup

- Component: The Linux kernel on hosts that run Gravwell services or ingesters
- Status: Affected
- Affected versions: All versions
- CWE: CWE-416: Use After Free
- CVSS 4.0 (Gravwell's assessment): 9.3 Critical, `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
- CVSS 3.1 (Gravwell's assessment): 9.8 Critical, `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

CVE-2026-98432 is a use-after-free in the Linux kernel during IPv4 TCP connection setup. An attacker on the
network can trigger the bug without credentials. It affects kernels from 4.4 up to the stable releases that
contain the fix.

Upstream references:

- [CVE record: CVE-2026-98432](https://www.cve.org/CVERecord?id=CVE-2026-98432)
- [NVD: CVE-2026-98432](https://nvd.nist.gov/vuln/detail/CVE-2026-98432)
- [Debian security tracker: CVE-2026-98432](https://security-tracker.debian.org/tracker/CVE-2026-98432)
- [oss-security: Go announcement of the MPTCP exploit](https://www.openwall.com/lists/oss-security/2026/10/30/1)
- [Go Issue #82717](https://go.dev/issue/82717)

## Summary

On 2026-10-29, the Go security team reported a demonstrated attack that ran code remotely through CVE-2026-98432. The
attack used Multipath TCP (MPTCP) connections, which programs built with Go 1.24 or later accept by default. The Go team
states that the bug is not specific to MPTCP, so a kernel update is necessary to fix it.

Gravwell builds current releases with Go 1.26, so Gravwell components that listen for connections accept MPTCP by
default. Every Linux host that runs Gravwell on a vulnerable kernel is affected.

## Mitigations

If you cannot reboot a host soon, run these commands on that host. They disable MPTCP and restart the Gravwell
services.

```
sudo sysctl -w net.mptcp.enabled=0
sudo systemctl restart 'gravwell_*'
```

The restart is necessary because a listener that is already open keeps MPTCP until its service restarts.

If a Gravwell container does not use `--network host`, start it with `--sysctl net.mptcp.enabled=0`. Such a
container has its own network stack. The host setting does not apply to it.

This setting blocks only the demonstrated attack. It does not fix the kernel bug.

## Changelog

- 2026-10-30: Initial publication.

Questions this advisory doesn't answer? Email the Gravwell Security Team at security@gravwell.io.