Vulnerability in the Linux kernel of Behnke Station and Behnke ControlCenter (CVE-2026-98432)

A vulnerability (CVE-2026-98432) has been identified in the networking code of the Linux kernel used by Behnke Station and Behnke ControlCenter. When a TCP connection is established over IPv4, IP options can be freed while the kernel still accesses them (use-after-free). An attacker who can send specially crafted network packets to the device may, in the worst case, read information, corrupt memory or crash the device.

Affected are Behnke Station firmware versions before 6.83 and Behnke ControlCenter versions before 1.0.498277.

An attack requires that TCP packets with IPv4 options reach the device and that a timing-dependent race condition is won. Many networks already drop such packets. If the devices are not operated directly reachable from the internet, the risk is significantly lower. An attack from the local network remains possible, however. No active exploitation is currently known.

Remedy

Update Behnke Station to firmware version 6.83 or later and Behnke ControlCenter to version 1.0.498277 or later.

If an immediate update is not possible:

• Operate the devices only in segregated networks that are not directly reachable from the internet.
• Configure your firewall to drop IPv4 packets with IP options addressed to the devices.