vDefend: Impact Assessment of CVE-2026-98432 - Linux Kernel TCP

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

CVE-2026-98432 is a use-after-free race condition located in the Linux kernel's standard IPv4 TCP handshake code. This involves Multipath TCP (MPTCP) and standard TCP.

Environment

Not Affected

• vDefend Security Services Platform 5.x (5.0.x, 5.1.x, 5.2.x) - is not affected.
• License Hub for vDefend and Avi 2.x and 5.1.2 - is not affected.
• vDefend 4.2.x / 9.x - vDefend Distributed Firewall, Gateway Firewall, and IDPS is not affected.

Resolution

vDefend Security Services Platform, License Hub for vDefend and Avi, and vDefend Firewall with ATP are not affected. Existing kernel hardening protections mitigate any potential for exploitation on vDefend products.