A memory handling vulnerability has been identified in the Linux kernel that RouterOS 7 is built on. The vulnerability can affect devices reachable from untrusted networks. RouterOS devices by default are protected from the internet side.
The issue is in how IPv4 TCP connections that carry optional IP settings are handled. In a specific timing case during connection setup, a small amount of memory can be released while it is still in use. In most situations this has no noticeable effect; in the worst case it may make the router unstable or cause it to restart. This is a Linux kernel vulnerability, assigned CVE-2026-98432. IPv6 connections are not affected.
Who is affected: RouterOS 7 devices that have not been updated to a release containing the fix. RouterOS 6 is not affected. The issue is triggered by traffic sent to a TCP service running on the router itself, not by traffic that is simply routed through it.
In the default configuration, the firewall drops unsolicited traffic arriving from the internet, so a router with the default firewall cannot be reached this way from the WAN. The risk is higher if management or other TCP services on the router have been opened to untrusted networks, or if the firewall has been disabled or replaced with permissive rules.
Fix status:
Until you upgrade, make sure TCP services on the router are not reachable from untrusted networks. Restrict management services to trusted addresses, keep the default firewall rules in place, and use a VPN such as WireGuard for remote access instead of opening management ports.
MikroTik always recommends keeping RouterOS devices up to date and using a strong firewall to limit exposure from untrusted networks.
Contact us about vulnerabilities