Linux TCP Flaws Trigger Cloud Slowdowns and New Use‑After‑Free

Linux TCP use‑after‑free lands with CVE‑2026‑98432

A new kernel flaw, CVE‑2026‑98432, grants remote attackers a high‑severity (CVSS 9.8) path to crash IPv4 TCP connections. The vulnerability stems from a use‑after‑free in the TCP receive path that can be triggered by crafted packets. Atlasum’s analysis shows the bug appears in the mainline Linux TCP stack and is not limited to a particular distro.

The advisory does not disclose a public exploit, but the write‑up notes that an attacker who can inject traffic into an unprotected TCP session can force the kernel to dereference a freed object, leading to a kernel panic. The issue is classified as a denial‑of‑service vector, but the underlying memory corruption could be leveraged for privilege escalation on vulnerable hosts.

Databricks sees AWS‑specific slowdowns after TCP SACK patches

Databricks reported a non‑deterministic performance regression that surfaced after the June 24, 2019 security update for the TCP Selective Acknowledgement (SACK) vulnerabilities. The patch was rolled out in a new Amazon Machine Image (AMI) that underpins the LXC containers running the Databricks Runtime (DBR).

In less than 0.2 % of runs, Spark jobs that write large DataFrames to Amazon S3 stalled for up to 15 minutes. The slowdown manifested as a single executor task lingering in the RUNNING state while all peers finished in seconds. Netstat and ss traces revealed a TCP socket stuck in CLOSE_WAIT with 97 KB of outbound data and 13 failed retransmissions. The next retransmission timer was set for 1 min 37 sec, yet the socket had not emitted a packet for over 9 min 51 sec, indicating the client never left the host.

Rolling back to the pre‑patch AMI eliminated the issue, confirming the regression originates in the patched TCP stack rather than Spark or S3. Canonical is preparing an Ubuntu 16.04 image that resolves the performance anomaly, and Databricks plans to adopt it once regression tests pass.

The TCP stack as a recurring attack surface

Both incidents expose a pattern: low‑level TCP code changes intended for security can inadvertently degrade performance or open new failure modes. The June 17, 2019 SACK disclosures warned of a remote DoS that could trigger a kernel panic, prompting an immediate patch. The same patch now appears to interfere with the TCP retransmission logic on certain AWS network paths, causing sockets to linger in CLOSE_WAIT and exhaust retransmission windows.

CVE‑2026‑98432 adds a fresh use‑after‑free vector to the same codebase. While the bug is unrelated to the SACK fixes, it underscores how complex the TCP implementation has become. The stack must juggle congestion control, selective acknowledgements, and memory management across a wide range of hardware and virtualized environments. A single misstep can ripple into cloud workloads that depend on predictable network latency.

The broader ecosystem sees similar risks. Vedere Labs’ AMNESIA:33 report catalogued 33 memory‑corruption bugs across four open‑source TCP/IP stacks—uIP, FNET, picoTCP, and Nut/Net—affecting millions of IoT, OT, and IT devices. Those stacks lack the extensive regression testing that Linux benefits from, yet they illustrate how pervasive TCP vulnerabilities are across the device spectrum.

Mitigation strategies and immediate work‑arounds

Databricks’ short‑term fix is to enable Spark speculation (setting spark.speculation=true) so that straggling tasks are duplicated and the faster replica can finish the job. This does not address the underlying socket stall but reduces the impact on end‑users.

Long‑term remediation requires a kernel update that corrects the retransmission timing bug introduced by the SACK patch. Canonical’s upcoming Ubuntu 16.04 image is the first publicly announced fix. Operators on other distros should monitor their kernel changelogs for patches that restore the expected TCP retransmission interval (max 2 minutes) and verify that sockets transition out of CLOSE_WAIT promptly.

For the CVE‑2026‑98432 use‑after‑free, administrators must apply the upstream Linux kernel update that includes the fix. Distributions that ship the vulnerable kernel version should issue security advisories and encourage users to upgrade. Network perimeter defenses—such as strict ingress filtering and rate limiting of malformed TCP packets—can reduce the attack surface while patches are rolled out.

What to watch next

The Linux kernel community is expected to publish a merged patch for CVE‑2026‑98432 within the next kernel release cycle. Keep an eye on the kernel mailing list for the exact commit hash and version number. On the cloud side, Databricks will announce the migration to the patched Ubuntu image; the rollout timeline will indicate when the AWS‑specific slowdown is fully mitigated. Finally, monitor any follow‑up disclosures from Vedere Labs, as additional AMNESIA:33 variants could surface and pressure vendors of embedded TCP stacks to release fixes.