Title: Critical 9.8-Rated Linux TCP Flaw (CVE-2026-98432): Red Hat Ships Fixes, Ubuntu’s Still in -proposed
Summary: The Linux kernel has a use-after-free in its IPv4 TCP connection handling, tracked as CVE-2026-98432 with a CVSS 3.1 score of 9.8 (Critical). It exists in kernel versions 4.4 and later: when the kernel passes the IP options of an incoming connection request to the new socket without copying them, a second CPU processing a retransmitted request — or a migrated request socket — can free the options while another worker is still reading them. An attacker exploiting it needs no credentials and no user interaction, only precise timing, and only IPv4 TCP packets carrying IP options; ordinary TCP options such as timestamps are unaffected and IPv6 is not affected on the main path. Exploitation requires sending connection requests with IPv4 options such as Record Route or Timestamp to any listening TCP port. Red Hat’s bulletin (RHSB-2026-016, public October 30, updated November 4) calls the impact Critical — Red Hat initially rated the flaw Moderate at 5.9 before raising it — and affected products include RHEL 8, 9 and 10 plus OpenShift (OpenStack Platform and Virtualization are potentially impacted through the RHEL kernel too). Red Hat shipped errata RHSA-2026:93414 (RHEL 8, kernel 4.18.0-553.182.1.el8_10), RHSA-2026:93412 (RHEL 9, 5.14.0-687.64.1.el9_8) and RHSA-2026:93413 (RHEL 10, 6.12.0-211.72.1.el10_2) on November 1, with a reboot required. Ubuntu’s fixes for the generic kernel — 5.15.0-203.213 on 22.04 LTS, 6.8.0-149.149 on 24.04 LTS, 7.0.0-43.43 on 26.04 LTS — sit in the -proposed pocket; Canonical’s blog explains users running their own kernel acceptance tests can install them from there while Canonical tests across more than 2,000 certified servers and devices before releasing to the ordinary archives. Ubuntu 26.10 is already fixed in 7.3.0-10.10, and fixes for still-supported older releases (20.04/18.04/16.04) are pending; the Ubuntu CVE page was last updated November 9 and still shows 24.04, 22.04 and 20.04 as “vulnerable work in progress” for the generic kernel. Canonical is explicit that the widely recommended workaround of disabling Multipath TCP is not enough — MPTCP is already disabled by default on RHEL, and Red Hat says such default systems remain affected; the Ubuntu Security Team calls security updates the only appropriate mitigation. As an interim measure both vendors publish an nftables rule that drops inbound IPv4 TCP packets with IP options — which reduces exposure but can’t fully prevent exploitation, doesn’t cover container traffic on the same host, and is not a substitute for patching. No vendor has reported real-world attacks on the flaw as of the current reporting.
References: