MikroTik published a security notice on 3 November confirming that RouterOS 7 inherits a use-after-free in the Linux IPv4 TCP stack, tracked as CVE-2026-98432. The same kernel flaw affects Linux from 4.4 onward, so the exposure is not confined to routers.
What happened
The bug sits in how the kernel handles IPv4 TCP connections that carry IP options such as Record Route or Timestamp. During connection setup a small options buffer can be freed while another CPU is still reading it, giving an attacker kernel memory disclosure, out-of-bounds writes or a kernel panic. The CVE record scores it 9.8 critical, reachable over the network with no privileges and no user interaction.
MikroTik is precise about the trigger: it is traffic sent to a TCP service running on the device itself, not traffic routed through it. Default firewall rules drop unsolicited WAN traffic, so a stock router cannot be reached this way. Routers with management services opened to the internet, or with the firewall relaxed to make remote support easier, can be.
Who is affected
- RouterOS 7 devices that have not been updated. RouterOS 6 is not affected.
- Linux servers and appliances on kernels older than 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 or 7.2.10, depending on branch.
- Any host exposing a TCP service on IPv4 to an untrusted network, including VPN gateways, mail relays and NAS boxes.
What to do now
Patch the kernel or the RouterOS build, then confirm the running version rather than the installed one.
- RouterOS: upgrade to 7.25.1 on stable, 7.24.6 on long-term, or 7.26beta5 on development.
- Linux: update to the fixed kernel for your branch and reboot. A kernel package that is installed but not booted fixes nothing.
- Until the reboot window, restrict management services to trusted source addresses and reach routers over WireGuard instead of exposing Winbox, SSH or the web interface.
- Audit firewall rules for any accept rule that places a router service on the WAN side.
What this means for South African businesses
Two of the most common pieces of infrastructure in a South African SME, a MikroTik router at the edge and a Linux server in the back office, share this flaw, so one patch cycle covers both and one skipped host leaves the gap open. The realistic exposure is a fibre install where the router was opened up for remote support and never locked down again, not a hardened data centre. Most SMEs will never see this exploited directly, but the risk concentrates on exactly those boxes.
Source: MikroTik security notice for CVE-2026-98432.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.