Linux kernel IPv4 TCP SYN handling use-after-free via RCU-unsafe inet_opt freeing

#!/usr/bin/env bash
# check_cve_2026_98432.sh — Check for CVE-2026-98432
# Linux kernel IPv4 TCP use-after-free in inet_opt handling
# Affected: 4.4 <= kernel < fixed version per branch
# Fixed: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3+

set -euo pipefail

KERNEL=$(uname -r)
# Extract major.minor.patch, stripping distro suffixes
VER=$(echo "$KERNEL" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')

if [ -z "$VER" ]; then
  echo "UNKNOWN — could not parse kernel version from: $KERNEL"
  exit 2
fi

MAJOR=$(echo "$VER" | cut -d. -f1)
MINOR=$(echo "$VER" | cut -d. -f2)
PATCH=$(echo "$VER" | cut -d. -f3)

version_ge() {
  # Returns 0 if $MAJOR.$MINOR.$PATCH >= $1.$2.$3
  local cmp_maj=$1 cmp_min=$2 cmp_pat=$3
  if [ "$MAJOR" -gt "$cmp_maj" ]; then return 0; fi
  if [ "$MAJOR" -lt "$cmp_maj" ]; then return 1; fi
  if [ "$MINOR" -gt "$cmp_min" ]; then return 0; fi
  if [ "$MINOR" -lt "$cmp_min" ]; then return 1; fi
  if [ "$PATCH" -ge "$cmp_pat" ]; then return 0; fi
  return 1
}

version_lt() {
  ! version_ge "$1" "$2" "$3"
}

echo "Kernel: $KERNEL (parsed: $MAJOR.$MINOR.$PATCH)"
echo "CVE: CVE-2026-98432 (ipv4 inet_opt UAF)"
echo "---"

# Not affected: kernel < 4.4
if version_lt 4 4 0; then
  echo "PATCHED — kernel predates the vulnerable commit (requires >= 4.4)"
  exit 0
fi

# Check each stable branch
RESULT="UNKNOWN"

if [ "$MAJOR" -eq 5 ] && [ "$MINOR" -eq 10 ]; then
  if version_ge 5 10 272; then RESULT="PATCHED"; else RESULT="VULNERABLE"; fi
elif [ "$MAJOR" -eq 5 ] && [ "$MINOR" -eq 15 ]; then
  if version_ge 5 15 223; then RESULT="PATCHED"; else RESULT="VULNERABLE"; fi
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 1 ]; then
  if version_ge 6 1 190; then RESULT="PATCHED"; else RESULT="VULNERABLE"; fi
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 6 ]; then
  if version_ge 6 6 159; then RESULT="PATCHED"; else RESULT="VULNERABLE"; fi
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 12 ]; then
  if version_ge 6 12 113; then RESULT="PATCHED"; else RESULT="VULNERABLE"; fi
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 18 ]; then
  if version_ge 6 18 56; then RESULT="PATCHED"; else RESULT="VULNERABLE"; fi
elif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 2 ]; then
  if version_ge 7 2 10; then RESULT="PATCHED"; else RESULT="VULNERABLE"; fi
elif version_ge 7 3 0; then
  RESULT="PATCHED"
elif [ "$MAJOR" -eq 4 ] || [ "$MAJOR" -eq 5 ] && [ "$MINOR" -lt 10 ]; then
  # Kernel 4.x (>= 4.4) or 5.x < 5.10 — EOL branches, no backport
  RESULT="VULNERABLE"
elif [ "$MAJOR" -eq 5 ] && [ "$MINOR" -gt 15 ] && [ "$MINOR" -lt 99 ]; then
  # 5.x branches between 5.15 and 6.1 — EOL, no backport
  RESULT="VULNERABLE"
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -gt 1 ] && [ "$MINOR" -lt 6 ]; then
  RESULT="VULNERABLE"
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -gt 6 ] && [ "$MINOR" -lt 12 ]; then
  RESULT="VULNERABLE"
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -gt 12 ] && [ "$MINOR" -lt 18 ]; then
  RESULT="VULNERABLE"
else
  # Distro kernel with custom minor — check distro advisories
  RESULT="UNKNOWN"
fi

# Also check for kpatch
KPATCH="not detected"
if command -v kpatch &>/dev/null; then
  if kpatch list 2>/dev/null | grep -qi '98432\|inet_opt'; then
    KPATCH="livepatch applied"
    RESULT="PATCHED"
  fi
fi

echo "kpatch: $KPATCH"
echo "Result: $RESULT"

case $RESULT in
  VULNERABLE) echo "ACTION: Upgrade kernel to a fixed version."; exit 1 ;;
  PATCHED)    echo "No action required for this CVE."; exit 0 ;;
  UNKNOWN)    echo "Could not determine status — check distro advisory."; exit 2 ;;
esac