Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Swati KhandelwalNov 03, 2026Vulnerability / Linux Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can lead to remote code execution, Red Hat and Canonical said. The Linux kernel's own CVE team rates the flaw 9.8 out of 10 on the CVSS scale. Red Hat, which initially rated it Moderate at 5.9, has raised its score to 9.8 and now calls it Critical. The bug has been present since Linux 4.4, and the upstream fix landed in October. When a server accepts an IPv4 TCP connection, the kernel passes IP options from the incoming request to the new socket without copying them. If the client retransmits its connection request while another processor still reads those options, the kernel can read memory it has already freed. An attacker triggers the race by sending connection requests that carry IPv4 Record Route or Timestamp options to any listening TCP port. No login is needed. IPv6 is not affected on the main path. Red Hat shipped RHSA-2026:93414 (RHEL 8), RHSA-2026:93412 (RHEL 9), and RHSA-2026:93413 (RHEL 10) on November 1. A reboot is needed after installing the update. 8.10 4.18.0-553.182.1.el8_10 RHSA-2026:93414 9.8 5.14.0-687.64.1.el9_8 RHSA-2026:93412 10.2 6.12.0-211.72.1.el10_2 RHSA-2026:93413 Canonical said on November 2 that fixes for Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS are in its -proposed pocket, an opt-in testing channel. Packages there do not install automatically. Canonical tests kernel updates across more than 2,000 certified servers and devices before releasing them to the regular update channel, and no release date has been given. 22.04 LTS (Jammy) 5.15.0-203.213 In -proposed 24.04 LTS (Noble) 6.8.0-149.149 In -proposed 26.04 LTS (Resolute) 7.0.0-43.43 In -proposed Administrators who need the fix before it reaches the regular channel can enable -proposed and install the kernel update by running: sudo add-apt-repository --component main --pocket proposed https://archive.ubuntu.com/ubuntu dpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install -t $(. /etc/os-release && echo $VERSION_CODENAME)-proposed --only-upgrade To check whether a system is running a fixed kernel, compare the output of uname -r against the versions in the tables above. Ubuntu 20.04, 18.04, and 16.04 have no fix yet. Older releases require Expanded Security Maintenance through Ubuntu Pro. Cloud, FIPS, and real-time kernel variants for Ubuntu are listed as work in progress on the Ubuntu CVE page with target versions, but Canonical's blog post covers only the generic kernel. Red Hat published an nftables rule on October 30 that drops inbound IPv4 TCP packets carrying IP options. The rule blocks the known trigger for the race but cannot fully prevent exploitation and may break workloads that depend on IPv4 options, Red Hat said. type filter hook input priority -310; policy accept; ip protocol tcp ip hdrlength > 5 counter drop The filter applies only to the host where it is loaded. Traffic between containers on the same host can bypass it, a member of the CIQ kernel team noted on the oss-security mailing list. Several sources have recommended disabling Multipath TCP (MPTCP) as a workaround. The flaw is in the IPv4 TCP path, not in MPTCP, and that advice alone is not enough, Canonical said. "The Ubuntu Security Team believes that security updates are the only appropriate mitigation." No vendor, CERT, or the kernel CVE team has reported attacks using this flaw. It was not listed in CISA's Known Exploited Vulnerabilities catalog as of the catalog's October 30 release. Anthropic said on October 27 that an unreleased, internal Claude research model wrote a remote root exploit for the flaw that works against Linux servers with an MPTCP listener, with no credentials and no user interaction. In its proof of concept, leaking a kernel address took 48 minutes and reaching a root shell took another 5 minutes. Anthropic has not published the exploit code. Proof-only code that triggers the race and detects the kernel echoing freed memory in a SYN-ACK has appeared on GitHub. It does not implement code execution. Amazon Linux scored the flaw 8.1 and rated it Important, saying the main outcome is a crash with possible memory corruption. Debian, Oracle Linux, and SUSE shipped fixes in October. Amazon Linux was fixed across all packages between October 24 and 30. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, linux, network security, operating system security, Vulnerability Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline AI-Generated Fake Login Pages Are Making Account Takeovers Easier TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Register for Free Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. ROI Calculator: See the Value of IAM Automation Calculate your savings on audits, app onboarding, and discovery. Try it now. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security