Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

Red Hat has shipped fixed kernels for CVE-2026-98432 in RHEL 8, 9 and 10, while Ubuntu fixes for 22.04 LTS, 24.04 LTS and 26.04 LTS remain in the -proposed testing channel with no regular release date. The IPv4 TCP use-after-free flaw is rated 9.8 out of 10 by the Linux kernel CVE team; Red Hat initially rated it Moderate at 5.9 but now calls it Critical at 9.8. A reboot is needed after installing an update, and interim mitigations are limited. This report follows our October 30 coverage, which explained how the flaw works and how to verify the patch.

What the flaw is

When a server accepts an IPv4 TCP connection, the kernel passes IP options from the incoming request to the new socket without copying them. If the client retransmits its connection request while another processor still reads those options, the kernel can read memory it has already freed. An attacker triggers the race by sending connection requests carrying IPv4 Record Route or Timestamp options to any listening TCP port. No login is needed, IPv6 is not affected on the main path, and the bug has been present since Linux 4.4. The upstream fix landed in October.

Patched releases and testing status

Red Hat shipped RHSA-2026:93414 for RHEL 8.10 with kernel 4.18.0-553.182.1.el8_10, RHSA-2026:93412 for RHEL 9.8 with kernel 5.14.0-687.64.1.el9_8, and RHSA-2026:93413 for RHEL 10.2 with kernel 6.12.0-211.72.1.el10_2. Canonical said fixes for Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS are in -proposed, with kernels 5.15.0-203.213, 6.8.0-149.149 and 7.0.0-43.43. Those packages do not install automatically. Canonical tests kernel updates across more than 2,000 certified servers and devices before release, and no release date has been given. Ubuntu 20.04, 18.04 and 16.04 have no fix yet; older releases require Expanded Security Maintenance through Ubuntu Pro. Cloud, FIPS and real-time kernel variants are listed as work in progress, while Canonical's blog post covers only the generic kernel.

Mitigation and exploitation status

Red Hat published an nftables rule on October 30 that drops inbound IPv4 TCP packets carrying IP options. It blocks the known trigger but cannot fully prevent exploitation and may break workloads that depend on IPv4 options. The filter applies only to the host where it is loaded, and traffic between containers on the same host can bypass it. Several sources recommended disabling Multipath TCP, but the flaw is in the IPv4 TCP path, not MPTCP, and that advice alone is not enough. Canonical said the Ubuntu Security Team believes security updates are the only appropriate mitigation. No vendor, CERT or kernel CVE team has reported attacks using the flaw, and it was not listed in CISA's Known Exploited Vulnerabilities catalog as of the October 30 release. Anthropic said an unreleased internal Claude research model wrote a remote root exploit that works against Linux servers with an MPTCP listener, with no credentials and no user interaction; leaking a kernel address took 48 minutes and reaching a root shell took another 5 minutes, and Anthropic has not published the exploit code. Proof-only code that triggers the race and detects the kernel echoing freed memory in a SYN-ACK has appeared on GitHub but does not implement code execution. Amazon Linux scored the flaw 8.1 and rated it Important, saying the main outcome is a crash with possible memory corruption. Debian, Oracle Linux and SUSE shipped fixes in October, and Amazon Linux was fixed across all packages between October 24 and 30.

Sources: The Hacker News