Critical Linux Kernel TCP Flaw (CVE-2026-98432) Patched by Red Hat, Ubuntu Fixes in Testing
Red Hat has released critical patches for a severe use-after-free vulnerability in the Linux kernel's IPv4 TCP code, rated 9.8 CVSS, while Ubuntu's fixes are currently in its opt-in testing channel.
Red Hat Enterprise Linux (RHEL) distributions 8, 9, and 10 have received critical security updates to address a high-severity vulnerability in the Linux kernel's IPv4 TCP implementation. The flaw, identified as CVE-2026-98432, is a use-after-free bug that allows remote, unauthenticated attackers to achieve code execution on vulnerable systems.
The vulnerability, present in the Linux kernel since version 4.4, was fixed upstream in October. The Linux kernel's CVE team assigned it a CVSS score of 9.8 out of 10, reflecting its critical nature. Red Hat initially classified the vulnerability as Moderate but has since upgraded its assessment to Critical.
The exploit mechanism involves a race condition within the kernel's handling of IP options for accepted IPv4 TCP connections. When a server accepts a connection, the kernel passes IP options to the socket without copying them. If a client retransmits its connection request while another processor is still reading these options, the kernel may attempt to access memory that has already been freed, leading to a use-after-free condition. Attackers can trigger this by sending connection requests with specific IPv4 options, such as Record Route or Timestamp, to any listening TCP port.
Red Hat has released updated kernels for RHEL 8, 9, and 10 through errata advisories RHSA-2026:93414, RHSA-2026:93412, and RHSA-2026:93413, respectively. Applying these updates requires a system reboot. Meanwhile, Canonical has made fixes available for Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS, but these are currently located in the -proposed pocket, an opt-in testing channel, with no firm timeline for general availability.
Administrators seeking to apply the Ubuntu fixes before they are widely released can manually enable the -proposed repository and install the updated kernel packages. However, Ubuntu emphasizes that security updates are the only appropriate mitigation, and older Ubuntu releases (20.04, 18.04, 16.04) currently lack a fix and may require Expanded Security Maintenance through Ubuntu Pro.
As a temporary mitigation, Red Hat has provided an nftables rule that drops inbound TCP packets containing IP options. While this rule can block the known exploit trigger, it is not a complete prevention and may disrupt workloads that rely on IPv4 options. Disabling Multipath TCP (MPTCP) has also been suggested, though Canonical notes this alone is insufficient as the vulnerability lies within the core IPv4 TCP path.
As of the latest reports, no active exploitation of CVE-2026-98432 in the wild has been confirmed by vendors or security agencies, and it has not been added to CISA's Known Exploited Vulnerabilities catalog. However, Anthropic has reported that an internal AI model was able to craft a remote root exploit for the flaw, demonstrating its potential for exploitation. Proof-of-concept code that triggers the race condition has also appeared on GitHub, though it does not include full code execution capabilities.