Fixed kernels for a use-after-free vulnerability in the Linux kernel’s IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu’s fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update.
The flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can lead to remote code execution, Red Hat and Canonical said.
The Linux kernel’s own CVE team rates the flaw 9.8 out of 10 on the CVSS scale. Red Hat, which initially rated it Moderate at 5.9, has raised its score to 9.8 and now calls it Critical. The bug has been present since Linux 4.4, and the upstream fix landed in October.
What the Flaw Is
When a server accepts an IPv4 TCP connection, the kernel passes IP options from the incoming request to the new socket without copying them. If the client retransmits its connection request while another processor still reads those options, the kernel can read memory it has already freed.
An attacker triggers the race by sending connection requests that carry IPv4 Record Route or Timestamp options to any listening TCP port. No login is needed. IPv6 is not affected on the main path.
Red Hat shipped RHSA-2026:93414 (RHEL 8), RHSA-2026:93412 (RHEL 9), and RHSA-2026:93413 (RHEL 10) on November 1. A reboot is needed after installing the update.
| RHEL Version | Fixed Kernel | Errata |
|---|---|---|
| 8.10 |
4.18.0-553.182.1.el8_10
|
RHSA-2026:93414 |
| 9.8 |
5.14.0-687.64.1.el9_8
|
RHSA-2026:93412 |
| 10.2 |
6.12.0-211.72.1.el10_2
|
RHSA-2026:93413 |
Canonical said on November 2 that fixes for Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS are in its -proposed pocket, an opt-in testing channel. Packages there do not install automatically.
Canonical tests kernel updates across more than 2,000 certified servers and devices before releasing them to the regular update channel, and no release date has been given.
| Ubuntu Release | -proposed Kernel | Status |
|---|---|---|
| 22.04 LTS (Jammy) |
5.15.0-203.213
|
In -proposed |
| 24.04 LTS (Noble) |
6.8.0-149.149
|
In -proposed |
| 26.04 LTS (Resolute) |
7.0.0-43.43
|
In -proposed |
| 20.04 / 18.04 / 16.04 | Pending |
Administrators who need the fix before it reaches the regular channel can enable -proposed and install the kernel update by running:
sudo add-apt-repository --component main --pocket proposed http://archive.ubuntu.com/ubuntu
dpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install -t $(. /etc/os-release && echo $VERSION_CODENAME)-proposed --only-upgrade
sudo rebootTo check whether a system is running a fixed kernel, compare the output of uname -r against the versions in the tables above.
Ubuntu 20.04, 18.04, and 16.04 have no fix yet. Older releases require Expanded Security Maintenance through Ubuntu Pro.
Cloud, FIPS, and real-time kernel variants for Ubuntu are listed as work in progress on the Ubuntu CVE page with target versions, but Canonical’s blog post covers only the generic kernel.
Interim Mitigation
Red Hat published an nftables rule on October 30 that drops inbound IPv4 TCP packets carrying IP options. The rule blocks the known trigger for the race but cannot fully prevent exploitation and may break workloads that depend on IPv4 options, Red Hat said.
table inet cve_2026_98432 {
chain input {
type filter hook input priority -310; policy accept;
ip protocol tcp ip hdrlength > 5 counter drop
}
}The filter applies only to the host where it is loaded. Traffic between containers on the same host can bypass it, a member of the CIQ kernel team noted on the oss-security mailing list.
Several sources have recommended disabling Multipath TCP (MPTCP) as a workaround. The flaw is in the IPv4 TCP path, not in MPTCP, and that advice alone is not enough, Canonical said. “The Ubuntu Security Team believes that security updates are the only appropriate mitigation.”
Exploitation Status
No vendor, CERT, or the kernel CVE team has reported attacks using this flaw. It was not listed in CISA’s Known Exploited Vulnerabilities catalog as of the catalog’s October 30 release.
Anthropic said on October 27 that an unreleased, internal Claude research model wrote a remote root exploit for the flaw that works against Linux servers with an MPTCP listener, with no credentials and no user interaction. In its proof of concept, leaking a kernel address took 48 minutes and reaching a root shell took another 5 minutes. Anthropic has not published the exploit code.
Proof-only code that triggers the race and detects the kernel echoing freed memory in a SYN-ACK has appeared on GitHub. It does not implement code execution.
Amazon Linux scored the flaw 8.1 and rated it Important, saying the main outcome is a crash with possible memory corruption. Debian, Oracle Linux, and SUSE shipped fixes in October. Amazon Linux was fixed across all packages between October 24 and 30.