CVE-2026-98432: Critical Linux IPv4 TCP Vulnerability Affecting MikroTik RouterOS 7

What it is, how it works, which RouterOS versions are affected, and what network operators should do now.

CVE-2026-98432 is a critical use-after-free vulnerability in the Linux kernel IPv4 TCP connection-handling path. It affects Linux kernels beginning with version 4.4 and can be triggered by specially crafted IPv4 TCP traffic sent to a listening TCP service.

The issue is important to network operators because RouterOS 7 is built on the Linux kernel. MikroTik has published an advisory confirming that affected RouterOS 7 devices should be upgraded. The vulnerability applies to TCP services running on the router itself; it is not triggered merely by IPv4 traffic being routed through the router.

Executive Summary

What Is a Use-After-Free Vulnerability?

A use-after-free vulnerability occurs when software releases a piece of memory but another portion of the program continues to use a pointer to that same memory. Once memory has been released, it may be reused for something else. Any later attempt to read from or write to that location can produce unpredictable behavior.

Depending on the exact timing and how memory is reused, the result may be a harmless failure, a process crash, a kernel panic, information disclosure, memory corruption, or—in more serious scenarios—code execution. Because this vulnerability exists in kernel networking code, a successful attack can affect the operating system itself rather than only one user-level application.

The Technical Issue: IPv4 TCP Connection Setup

The affected code is part of the Linux IPv4 TCP handshake path. When a remote client begins a TCP connection, the receiving system creates and manages a request socket while the connection is progressing through the SYN and SYN-ACK stages.

In the affected path, the Linux kernel can transfer ownership of IPv4 option data from the request socket to a newly created child socket without making a copy. Under a specific race condition, another CPU can still be processing a retransmitted SYN and building a SYN-ACK response while the child socket or request-socket-related memory is being released.

The affected code reads IPv4 option information while protected by an RCU read lock. However, the old cleanup path used a normal memory free operation instead of delaying the free until after the required RCU grace period. That mismatch allows the IPv4 option data to be freed while a concurrent networking path still expects it to exist.

Why IPv4 Options Matter

The vulnerability involves IPv4 TCP connection requests that carry IPv4 options. IPv4 options are uncommon in normal internet traffic, but they are valid parts of the protocol and can be supplied in specially constructed packets. A malicious actor can use crafted packets and carefully timed retransmissions to attempt to trigger the vulnerable race condition.

The kernel fix changes the cleanup behavior so the affected option structures are released only after an RCU grace period. This allows in-progress readers to finish safely before the memory becomes available for reuse.

Severity and Potential Impact

The Linux kernel CVE record assigns CVE-2026-98432 a CVSS v3.1 score of 9.8 Critical: network reachable, low attack complexity, no privileges required, and no user interaction required. The potential security impact includes confidentiality, integrity, and availability consequences.

In real operational terms, an attacker may be able to cause a vulnerable device to become unstable, reboot, or stop handling traffic correctly. Other vendor advisories also note the possibility of memory disclosure or memory corruption. Reliable code execution is generally more difficult than causing a crash, but should not be treated as impossible when a critical kernel-level memory-corruption issue is involved.

Affected Linux Kernel Versions

The Linux kernel CVE team identifies the issue as introduced in Linux kernel 4.4. Fixed versions have been published across supported kernel branches. Operating-system vendors may backport the correction into their own package versions, so always use your vendor’s advisory and current package repository as the final authority.

MikroTik RouterOS Impact

MikroTik has confirmed that the vulnerability affects RouterOS 7 devices that have not been updated to a release containing the fix. RouterOS 6 is not affected.

Importantly, this vulnerability is triggered by traffic sent to a TCP service operating on the router—not by ordinary customer, subscriber, transit, or routed traffic passing through the router. Exposure depends on whether the router accepts TCP connections from untrusted sources.

A default MikroTik firewall normally drops unsolicited WAN traffic to the router itself. That substantially reduces exposure. Risk increases when the input chain is permissive, the default firewall has been removed, or management services have been exposed to the internet.

Which RouterOS Services Should Be Reviewed?

Review every TCP service that listens on the router and determine whether it can be reached from an untrusted network. Common examples include:

This is also a good opportunity to remove unused management services, restrict permitted source addresses, and confirm that remote administration occurs over WireGuard or another approved VPN rather than through publicly exposed management ports.

Recommended RouterOS Response Plan

1. Inventory RouterOS versions. Identify every RouterOS 7 device in production, including edge routers, core routers, remote CPE management routers, test systems, and lab equipment that can be reached from untrusted networks.
2. Upgrade affected systems. Move to RouterOS stable 7.25.1 or later, or RouterOS long-term 7.24.6 or later.
3. Review the input chain. Confirm unsolicited WAN-originated traffic to the router is dropped.
4. Restrict management services. Allow WinBox, SSH, WebFig, API, and other management access only from defined trusted networks or VPN address pools.
5. Disable services you do not use. Every listening TCP service adds potential attack surface.
6. Use a VPN for administration. WireGuard is an excellent option for securely reaching RouterOS management services without opening them to the public internet.
7. Validate after maintenance. Confirm the installed RouterOS version, verify routing and monitoring, and review firewall logs after the change window.

Checking RouterOS Version and Updates

The following commands can be used to review the current RouterOS version and check for updates. Follow your normal change-control, backup, and maintenance-window process before installing an update on production equipment.

/system resource print
/system package update check-for-updates

If your organization uses the long-term release channel, confirm the configured channel before checking for updates:

/system package update
set channel=long-term
check-for-updates

Linux Server and Cloud Workload Considerations

This CVE is not limited to routers. Linux servers, virtual machines, containers, load balancers, appliances, and cloud workloads using affected kernels should also be reviewed. Linux distribution vendors may issue fixes as backported kernel packages, meaning a package version may not look identical to the upstream kernel version listed above.

Apply the updated kernel package supplied by your operating-system vendor and reboot the system. A kernel update alone is not sufficient until the host is running the new kernel. Organizations should pay particular attention to internet-facing systems, systems with public TCP listeners, and environments using Multipath TCP or advanced TCP service architectures.

The Bottom Line

CVE-2026-98432 is a serious kernel-level IPv4 TCP vulnerability with a straightforward operational response: patch affected systems and limit TCP services exposed to untrusted networks. For MikroTik environments, the priority is to upgrade RouterOS 7 devices to a fixed release and verify that the router input firewall does not allow public access to management services.

A secure firewall policy is an important layer of protection, but it should not be considered a replacement for upgrading. The permanent resolution is to run a RouterOS release containing MikroTik’s fix.

References

• MikroTik Security Advisory: CVE-2026-98432
• CVE Program Record: CVE-2026-98432
• NIST National Vulnerability Database: CVE-2026-98432
• Linux Kernel CVE Record and Fixed Kernel Versions