Critical TCP use-after-free: CVE-2026-98432

Can we call it tcp2shell?

Yet another classic C style use after free + race condition according to the AI slop written blog post:

> If the new socket is freed first, the options are freed with a plain kfree() while still in use: a use-after-free. A similar race exists when request sockets are migrated between listeners, which only happens with net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE eBPF program.

I think we need to now discuss whether if Linux (and C) are still fit for purpose in the AI age given how common the C style vulnerabilities are quickly being discovered, everywhere in the kernel.