Kernel fixes are now available for CVE-2026-98432, the use-after-free flaw in the Linux kernel’s IPv4 TCP code that we covered on October 30 when no distribution had shipped a patch. Per The Hacker News, Red Hat released updates for Red Hat Enterprise Linux (RHEL) 8, 9 and 10 on November 1, while Canonical’s fixes for Ubuntu 22.04, 24.04 and 26.04 LTS are only in the opt-in -proposed testing channel, with no date for the regular update channel. Red Hat, which first rated the flaw Moderate (5.9), now lists it as Critical in its security bulletin.
The bug can be triggered remotely and without a login by sending TCP connection requests that carry IPv4 options (Record Route or Timestamp) to any listening port. Red Hat’s bulletin says an attacker needs precise timing but no privileges or user interaction, and that Multipath TCP (MPTCP) is not a required condition, so the flaw is not limited to systems with MPTCP enabled. No vendor, CERT or the kernel CVE team has reported attacks using it, according to The Hacker News. Anthropic has said an unreleased internal model wrote a remote root exploit for it, and that exploit has not been published.
How to check if you’re affected
Affected versions are Linux kernels from 4.4 onward on systems with IPv4 TCP networking, per Canonical. Run uname -r and compare the output with the fixed kernels below.
Affected products named by Red Hat are RHEL 8, 9 and 10 and OpenShift Container Platform 4, whose nodes run the RHEL CoreOS kernel; Red Hat says any product relying on the RHEL kernel may be affected. Fixed RHEL kernels:
- RHEL 8.10:
4.18.0-553.182.1.el8_10(RHSA-2026:93414) - RHEL 9.8:
5.14.0-687.64.1.el9_8(RHSA-2026:93412) - RHEL 10.2:
6.12.0-211.72.1.el10_2(RHSA-2026:93413)
Canonical’s status for Ubuntu: 22.04 (5.15.0-203.213), 24.04 (6.8.0-149.149) and 26.04 (7.0.0-43.43) have fixes in -proposed; 16.04, 18.04 and 20.04 are listed as fix pending; 26.10 is fixed in 7.3.0-10.10. Canonical’s blog post shows how to install from -proposed; packages there are not installed by default, and a reboot is needed after any kernel update.
If you cannot patch yet, Red Hat published an nftables rule that drops inbound IPv4 TCP packets carrying IP options. Red Hat says it reduces exposure but cannot fully prevent exploitation, may disrupt workloads that rely on IP options, and should be tested first. Canonical says security updates are the only appropriate mitigation. Per The Hacker News, disabling MPTCP alone is not enough.
Sources
- Red Hat Security Bulletin RHSB-2026-016: Use-after-free in kernel IPv4 (CVE-2026-98432)
- Canonical: Fixes available in -proposed pocket for CVE-2026-98432
- Ubuntu security page for CVE-2026-98432
- Red Hat advisory RHSA-2026:93412 (RHEL 9)
- The Hacker News: Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing