Critical Linux Kernel Flaw Now Patched on Red Hat, While Ubuntu Fixes Remain in Testing

A serious vulnerability in the Linux kernel's IPv4 TCP code, tracked as CVE-2026-98432, can be reached by a remote attacker without logging in and can lead to remote code execution. The Linux kernel's CVE team rates it 9.8 out of 10. Red Hat first rated it Moderate at 5.9, then raised its score to 9.8 and now calls it Critical. The bug has been present since Linux 4.4, and the upstream fix landed in October.

The flaw is a use-after-free error. When a server accepts an IPv4 TCP connection, the kernel passes IP options from the incoming request to the new socket without copying them. If the client resends its connection request while another processor is still reading those options, the kernel can read memory that has already been freed. An attacker can trigger this by sending connection requests carrying certain IPv4 options to any listening TCP port. IPv6 is not affected on the main path.

Red Hat released fixes for RHEL 8, 9 and 10 on November 1 (RHSA-2026:93414, RHSA-2026:93412 and RHSA-2026:93413), and a reboot is required after installing. Canonical said on November 2 that fixes for Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS are in its opt-in -proposed testing channel, so they do not install automatically, and no date has been given for the regular update. Ubuntu 20.04, 18.04 and 16.04 have no fix yet, and older releases need Expanded Security Maintenance through Ubuntu Pro. Cloud, FIPS and real-time Ubuntu kernels are still listed as work in progress.