Two critical vulnerabilities in the IPv4 stack in the Linux Kernel
Description
Two critical security vulnerabilities targeting the Linux kernel’s IPv4 stack have recently been disclosed. Linux serves as a core operating system across our infrastructure.
The identified vulnerabilities are:
- CVE-2026-98432: ipv4: free inet_opt and ireq_opt after an RCU grace period
https://www.cve.org/CVERecord?id=CVE-2026-98432
CVSS 3.1 vector and score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H – 9.8 (Critical)
- CVE-2026-99999: ipv4: validate checksum_start before completing checksum
https://www.cve.org/CVERecord?id=CVE-2026-99999
CVSS 3.1 vector and score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H – 9.3 (Critical)
Although Linux distributions are integrated throughout our production environments, our internal network architecture significantly mitigates the operational impact of these vulnerabilities.
Our Security and Engineering teams have evaluated the threat and deployed proactive countermeasures to secure all targeted infrastructure against potential exploits. Continuous monitoring remains active across all systems, and no evidence of unauthorized access or compromise has been detected. Core services continue to operate normally with no disruption to data security or system performance.