Overview
Fixed kernels for CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP code, are now available for Red Hat Enterprise Linux 8, 9, and 10. Ubuntu's fixes for its three newest LTS releases remain in the opt-in -proposed channel with no date for a regular update.
The Flaw
When a server accepts a connection, IP options from the request are passed to the new socket without being copied. If the client retransmits during a race, the kernel can read freed memory. The bug has been present since Linux 4.4, and the upstream fix landed in October.
A remote, unauthenticated attacker can trigger it by sending connection requests carrying IPv4 Record Route or Timestamp options to any listening TCP port. IPv6 is not affected on the main path.
Severity Ratings Differ
| Source | Rating |
|---|---|
| Linux kernel CVE team | 9.8 CVSS |
| Red Hat | Initially 5.9 (Moderate), raised to 9.8 (Critical) |
| Amazon Linux | 8.1 (Important), main outcome described as a crash with possible memory corruption |
Exploitation Status
No vendor, CERT, or kernel CVE team has reported in-the-wild attacks, and the flaw was not in CISA's KEV catalog as of October 30. Anthropic said an internal research model wrote a root exploit for an MPTCP-listener configuration but has not published it. Public proof-of-concept code detects the race but does not execute code.
Fixed Versions
| Distribution | Fixed Kernel | Advisory |
|---|---|---|
| RHEL 8.10 | 4.18.0-553.182.1.el8_10 | RHSA-2026:93414 |
| RHEL 9.8 | 5.14.0-687.64.1.el9_8 | RHSA-2026:93412 |
| RHEL 10.2 | 6.12.0-211.72.1.el10_2 | RHSA-2026:93413 |
| Ubuntu 22.04 LTS | 5.15.0-203.213 | In -proposed only |
| Ubuntu 24.04 LTS | 6.8.0-149.149 | In -proposed only |
| Ubuntu 26.04 LTS | 7.0.0-43.43 | In -proposed only |
A reboot is required after installing the Red Hat kernels. Debian, Oracle Linux, and SUSE shipped fixes in October, and Amazon Linux fixed all packages between October 24 and 30. Ubuntu 20.04, 18.04, and 16.04 have no fix yet, and older releases need Ubuntu Pro (ESM). Cloud, FIPS, and real-time Ubuntu variants are in progress.
Mitigation
Red Hat published an nftables rule (October 30) that drops inbound IPv4 TCP packets carrying IP options. It blocks the known trigger but cannot fully prevent exploitation and may break workloads that rely on IPv4 options. It applies only to the host where it is loaded, so container-to-container traffic on the same host can bypass it. Disabling MPTCP is not sufficient because the flaw is in the IPv4 TCP path; Canonical states that security updates are the only appropriate mitigation.
Recommended Actions
- Patch and reboot RHEL, Debian, Oracle Linux, SUSE, and Amazon Linux systems now, prioritizing internet-facing hosts.
- On Ubuntu, evaluate the
-proposedkernels for exposed systems, or apply the nftables rule as a stopgap. - Filter IPv4 packets with Record Route or Timestamp options at the network edge where feasible.
- Track the CVE against CISA KEV for any change in exploitation status.