Summary
Linux kernel IPv4 TCP use-after-free in the AF_ALG / algif_aead socket interface allows local users to write 4 bytes into any readable page cache, chaining to root via splice()/AF_ALG (CVE-2026-98432 / TF Escape). Affects Proxmox, Debian, Alpine, Raspberry Pi, TrueNAS, Docker/LXC hosts.
Severity
Critical — CVSS 9.8 (Deep Red).
Affected Asset
Linux kernel 4.4+ (AF_ALG / crypto: algif_aead socket interface; splice() syscall path).
Affected Endpoint
AF_ALG / crypto: algif_aead socket interface; splice() syscall path.
Prerequisites
Local unprivileged access; kernel built with AF_ALG / algif_aead; unpatched kernel (4.4+).
Evidence
Public PoC (732 bytes) achieves root; vendor advisories from Red Hat, Debian, Ubuntu confirm; NVD analysis verified.
Impact
Full root privilege escalation; container breakout possible; host compromise from unprivileged container/user.
Root Cause
In-place operation in algif_aead corrupts page-cache writes; splice() permits 4-byte overwrite of arbitrary readable files.
Remediation
Update to fixed kernel (Debian 13 / Ubuntu 24.04 LTS / RHEL 10 patched); disable algif_aead via modprobe if update delayed; reboot after patch.
Verification Steps
Check kernel version against vendor patches; confirm algif_aead module disabled if unpatched; test local escalation with safe PoC.