Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing
Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update.
Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update.
The flaw, tracked as CVE-2026-98432 , can be reached by a remote, unauthenticated attacker and can lead to remote code execution, Red Hat and Canonical said.
The Linux kernel's own CVE team rates the flaw 9.8 out of 10 on the CVSS scale.
When a server accepts an IPv4 TCP connection, the kernel passes IP options from the incoming request to the new socket without copying them, and no vendor, CERT, or the kernel CVE team has reported attacks using this flaw.
Canonical tests kernel updates across more than 2,000 certified servers and devices before releasing them to the regular update channel, and no release date has been given.
Administrators who need the fix before it reaches the regular channel can enable -proposed and install the kernel update by running: To check whether a system is running a fixed kernel, compare the output of uname -r against the versions in the tables above.
If the client retransmits its connection request while another processor still reads those options, the kernel can read memory it has already freed.
Traffic between containers on the same host can bypass it, a member of the CIQ kernel team noted on the oss-security mailing list.
Cloud, FIPS, and real-time kernel variants for Ubuntu are listed as work in progress on the Ubuntu CVE page with target versions, but Canonical's blog post covers only the generic kernel.
The rule blocks the known trigger for the race but cannot fully prevent exploitation and may break workloads that depend on IPv4 options, Red Hat said.
It was not listed in CISA's Known Exploited Vulnerabilities catalog as of the catalog's October 30 release.
The bug has been present since Linux 4.4, and the upstream fix landed in October.
Canonical said on November 2 that fixes for Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS are in its -proposed pocket, an opt-in testing channel.
Several sources have recommended disabling Multipath TCP (MPTCP) as a workaround.
What happened
Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update.
The flaw, tracked as CVE-2026-98432 , can be reached by a remote, unauthenticated attacker and can lead to remote code execution, Red Hat and Canonical said.
The Linux kernel's own CVE team rates the flaw 9.8 out of 10 on the CVSS scale.
What changed
When a server accepts an IPv4 TCP connection, the kernel passes IP options from the incoming request to the new socket without copying them, and no vendor, CERT, or the kernel CVE team has reported attacks using this flaw.
Who is affected
Canonical tests kernel updates across more than 2,000 certified servers and devices before releasing them to the regular update channel, and no release date has been given.
Administrators who need the fix before it reaches the regular channel can enable -proposed and install the kernel update by running: To check whether a system is running a fixed kernel, compare the output of uname -r against the versions in the tables above.
Why it matters
If the client retransmits its connection request while another processor still reads those options, the kernel can read memory it has already freed.
Traffic between containers on the same host can bypass it, a member of the CIQ kernel team noted on the oss-security mailing list.
Technical details
Cloud, FIPS, and real-time kernel variants for Ubuntu are listed as work in progress on the Ubuntu CVE page with target versions, but Canonical's blog post covers only the generic kernel.
The rule blocks the known trigger for the race but cannot fully prevent exploitation and may break workloads that depend on IPv4 options, Red Hat said.
It was not listed in CISA's Known Exploited Vulnerabilities catalog as of the catalog's October 30 release.
Response
The bug has been present since Linux 4.4, and the upstream fix landed in October.
Canonical said on November 2 that fixes for Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS are in its -proposed pocket, an opt-in testing channel.
What security teams should do
Several sources have recommended disabling Multipath TCP (MPTCP) as a workaround.
Korea Sets New Record with Binance $6.43B Crypto Theft — The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to a North Korean hacking group called TraderTraitor.
Attribution
The Hacker News: Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update.
The Hacker News: Some attacks this week didn't need much of a trick.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.