Fixed kernels addressing a use-after-free vulnerability in the **Linux** kernel's IPv4 TCP code are now available for **Red Hat Enterprise Linux** (RHEL) 8, 9, and 10. Meanwhile, **Ubuntu**'s fixes for its three newest long-term support (LTS) releases remain in its opt-in testing channel with no immediate date for a regular update. The flaw, tracked as **CVE-2026-98432**, can be exploited by a remote, unauthenticated attacker and can lead to remote code execution, as confirmed by **Red Hat** and **Canonical**.  The **Linux** kernel's own CVE team rates the flaw a critical 9.8 out of 10 on the CVSS scale. **Red Hat**, which initially rated it Moderate at 5.9, has since raised its score to 9.8 and now classifies it as Critical. The bug has been present since **Linux** 4.4, with the upstream fix landing in October. ### Understanding the Flaw When a server accepts an IPv4 TCP connection, the kernel passes IP options from the incoming request to the new socket without copying them. If the client retransmits its connection request while another processor still reads those options, the kernel can read memory it has already freed. This creates a use-after-free condition. An attacker triggers this race condition by sending connection requests that carry IPv4 Record Route or Timestamp options to any listening TCP port. No authentication or login is required. Notably, IPv6 is not affected on the main path. ### Patch Availability and Status **Red Hat** shipped patches **RHSA-2026:93414** (RHEL 8), **RHSA-2026:93412** (RHEL 9), and **RHSA-2026:93413** (RHEL 10) on November 1. A system reboot is necessary after installing these updates. | RHEL Version | Fixed Kernel | Errata | | :----------- | :------------------- | :-------------- | | 8.10 | `4.18.0-553.182.1.el8_10` | RHSA-2026:93414 | | 9.8 | `5.14.0-687.64.1.el9_8` | RHSA-2026:93412 | | 10.2 | `6.12.0-211.72.1.el10_2` | RHSA-2026:93413 | **Canonical** announced on November 2 that fixes for **Ubuntu** 22.04 LTS, 24.04 LTS, and 26.04 LTS are available in its *`-proposed`* pocket, an opt-in testing channel. Packages in this channel do not install automatically. **Canonical** rigorously tests kernel updates across over 2,000 certified servers and devices before releasing them to the regular update channel, and no specific release date for the general availability of these patches has been provided yet. | Ubuntu Release | -proposed Kernel | Status | | :---------------- | :------------------ | :---------- | | 22.04 LTS (Jammy) | `5.15.0-203.213` | In -proposed| | 24.04 LTS (Noble) | `6.8.0-149.149` | In -proposed| | 26.04 LTS (Resolute)| `7.0.0-43.43` | In -proposed| | 20.04 / 18.04 / 16.04| Pending | | Administrators requiring the fix before it reaches the regular channel can enable the *`-proposed`* repository and install the kernel update by executing the following commands: To verify if a system is running a patched kernel, compare the output of `uname -r` against the versions listed in the tables above. **Ubuntu** 20.04, 18.04, and 16.04 currently have no fix available. Older releases require **Expanded Security Maintenance** through **Ubuntu Pro**. Cloud, FIPS, and real-time kernel variants for **Ubuntu** are listed as work in progress on the **Ubuntu** CVE page with target versions, but **Canonical**'s blog post primarily covers the generic kernel. ### Interim Mitigation Strategies **Red Hat** published an **nftables** rule on October 30 that drops inbound IPv4 TCP packets carrying IP options. While this rule blocks the known trigger for the race condition, it cannot fully prevent exploitation and may disrupt workloads that rely on IPv4 options, as noted by **Red Hat**. This filter applies only to the host where it is loaded. Traffic between containers on the same host can bypass it, as a member of the **CIQ** kernel team highlighted on the `oss-security` mailing list. Several sources have recommended disabling **Multipath TCP** (MPTCP) as a workaround. However, **Canonical** clarifies that the flaw is in the IPv4 TCP path, not in **MPTCP**, and this advice alone is insufficient. The **Ubuntu Security Team** emphasizes that security updates are the only appropriate mitigation. ### Exploitation Status and Proof-of-Concept As of now, no vendor, **CERT**, or the kernel CVE team has reported active attacks leveraging this flaw. It was not listed in **CISA**'s Known Exploited Vulnerabilities catalog as of its October 30 release. Notably, **Anthropic** announced on October 27 that an unreleased, internal **Claude** research model successfully developed a remote root exploit for the flaw. This exploit works against **Linux** servers with an **MPTCP** listener, requiring no credentials and no user interaction. In their proof of concept, leaking a kernel address took 48 minutes, and achieving a root shell took an additional 5 minutes. **Anthropic** has not published the exploit code. Proof-only code that triggers the race and detects the kernel echoing freed memory in a SYN-ACK has appeared on **GitHub**, though it does not implement code execution. **Amazon Linux** rated the flaw 8.1 and classified it as Important, indicating that the primary outcome is a crash with potential memory corruption. **Debian**, **Oracle Linux**, and **SUSE** shipped fixes in October. **Amazon Linux** was patched across all packages between October 24 and 30.