RED Hat has issued kernel updates for a critical use-after-free vulnerability in Linux’s IPv4 TCP code. Tracked as CVE-2026-98432, the flaw can be triggered remotely without authentication and may allow code execution. The Linux kernel’s CVE team rates it 9.8 out of 10 on the CVSS scale; Red Hat raised its assessment from Moderate to Critical, also scoring it 9.8.

The bug occurs when a server accepts an IPv4 TCP connection and the kernel handles IP options supplied with the request. If a client retransmits the request while another processor is still reading those options, the kernel may access memory that has already been freed. The trigger involves sending connection requests with IPv4 Record Route or Timestamp options to a listening TCP port. IPv6 is not affected on the main path.

Red Hat released updates for RHEL 8, 9 and 10 on November 1. The fixed kernels are 4.18.0-553.182.1.el8_10 for RHEL 8.10, 5.14.0-687.64.1.el9_8 for RHEL 9.8, and 6.12.0-211.72.1.EL10_2 for RHEL 10.2. Systems need to be rebooted after installation.

Canonical said on November 2 that fixes for Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS are available in the -proposed pocket, an opt-in testing channel whose packages do not install automatically. The proposed kernel versions are 5.15.0-203.213, 6.8.0-149.149 and 7.0.0-43.43, respectively. Canonical has not announced when they will reach the regular update channel. Ubuntu 20.04, 18.04 and 16.04 do not yet have fixes.

Red Hat has also published an nftables rule intended to drop inbound IPv4 TCP packets carrying IP options. The company says the rule blocks the known trigger but does not fully prevent exploitation and may disrupt workloads that rely on IPv4 options. It only applies to the host where it is loaded; traffic between containers on the same host may bypass it.

No vendor, CERT or the kernel CVE team has reported attacks exploiting the flaw, and it was not listed in CISA’s Known Exploited Vulnerabilities catalog in its October 30 release. Anthropic said an unreleased internal research model had produced a remote root exploit for Linux servers with an MPTCP listener, but the exploit code has not been published. Proof-of-concept code that triggers the race has appeared on GitHub, but it does not achieve code execution.

Debian, Oracle Linux and SUSE released fixes in October. Amazon Linux rated the issue 8.1 and Important, citing a crash with possible memory corruption, and said it had updated affected packages between October 24 and 30.

Sources: The Hacker News.