"The Linux kernel's own CVE team rates the flaw 9.8 out of 10 on the CVSS scale," the vendors say — a score that reflects a remotely reachable use-after-free in the IPv4 TCP path that can lead to remote code execution (CVE-2026-98432).
Severity, timing, and vendor advisories
The flaw is tracked as CVE-2026-98432 and — according to the Linux kernel CVE team — carries a 9.8/10 CVSS score. Red Hat initially classified the issue as Moderate (5.9) but raised its assessment to 9.8 and now calls the bug Critical. The upstream fix landed in October, and Red Hat published fixes for Red Hat Enterprise Linux 8, 9, and 10 on November 1 (RHSA-2026:93414 for RHEL 8; RHSA-2026:93412 for RHEL 9; RHSA-2026:93413 for RHEL 10). Red Hat notes a system reboot is required after installing the update.
How the vulnerability is triggered
The kernel contains a use-after-free in the IPv4 TCP code that arises when the kernel passes IP options from an incoming connection request to the new socket without copying them. If a client retransmits its connection request while another processor is still reading those options, the kernel can read memory it has already freed. An attacker can trigger the race by sending connection requests that carry IPv4 Record Route or Timestamp options to any listening TCP port; no login is required. The main IPv6 path is not affected.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogUbuntu testing channel and other vendor responses
Canonical said on November 2 that fixes for Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS are currently in its -proposed pocket, an opt-in testing channel; packages there do not install automatically and Canonical tests kernel updates across more than 2,000 certified servers and devices before moving them into the regular channel. No regular-release date has been given. Administrators who need the fix immediately can opt into -proposed and install the kernel update; Canonical published the vendor-recommended commands (opt-in shown below).
- sudo add-apt-repository --component main --pocket proposed https://archive.ubuntu.com/ubuntu
- dpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install -t $(. /etc/os-release && echo $VERSION_CODENAME)-proposed --only-upgrade
- sudo reboot
Canonical also said that Ubuntu 20.04, 18.04 and 16.04 have no fix yet and that older releases require Expanded Security Maintenance through Ubuntu Pro. Cloud, FIPS, and real-time kernel variants are listed as work in progress on Canonical's CVE page; the blog post covers only the generic kernel.
Other vendors moved earlier: Debian, Oracle Linux and SUSE shipped fixes in October. Amazon Linux scored the flaw 8.1 (Important) and said the main outcome is a crash with possible memory corruption; Amazon Linux fixes were rolled out across packages between October 24 and October 30.
Interim mitigations: nftables and MPTCP discussion
Red Hat published an nftables rule on October 30 that drops inbound IPv4 TCP packets carrying IP options. The rule — offered as a host-level filter — blocks the known trigger for the race but, Red Hat warns, cannot fully prevent exploitation and may break workloads that depend on IPv4 options. The sample rule Red Hat published reads:
- table inet cve_2026_98432 {{
- chain input {{
- type filter hook input priority -310; policy accept;
- ip protocol tcp ip hdrlength > 5 counter drop
- }}
- }}
That filter applies only to the host where it is loaded; traffic between containers on the same host can bypass it, a member of the CIQ kernel team noted. Several sources recommended disabling Multipath TCP (MPTCP) as a workaround, but Canonical cautioned that the flaw is in the IPv4 TCP path and that disabling MPTCP alone is not sufficient. "The Ubuntu Security Team believes that security updates are the only appropriate mitigation," Canonical said.
Exploitation status, public proofs, and third‑party research
No vendor, CERT, or the kernel CVE team has reported attacks using this flaw, and the vulnerability was not listed in CISA's Known Exploited Vulnerabilities catalog as of the catalog's October 30 release. A proof-only program that triggers the race and detects the kernel echoing freed memory in a SYN-ACK has appeared on GitHub; that code does not implement code execution. Separately, Anthropic said on October 27 that an unreleased, internal Claude research model produced a remote-root exploit that works against Linux servers with an MPTCP listener, requiring no credentials and no user interaction; in Anthropic's proof of concept, leaking a kernel address took 48 minutes and reaching a root shell took another five minutes. Anthropic has not published that exploit code.
What this means for security teams, cloud operators, and administrators
- Security teams should treat RHEL 8/9/10 updates released November 1 as high priority and plan for required reboots after deployment.
- Ubuntu administrators who cannot wait for the regular update channel may opt into -proposed to get the kernel update immediately, but should weigh that path's testing posture and the vendor's guidance.
- Cloud operators and container hosts should note that the nftables host filter may be bypassed by intra-host container traffic and that vendor-supplied fixes for other distributions (Debian, Oracle Linux, SUSE, Amazon Linux) landed in October; Amazon reported fixes rolled out between October 24 and 30.
- Organizations still on older Ubuntu releases will need Expanded Security Maintenance (Ubuntu Pro) to receive fixes, per Canonical.
The record is concrete on patches and on the technical trigger; the open questions remaining in the public record are when Ubuntu will move fixes out of -proposed into regular updates and whether public exploit code that achieves RCE will appear beyond the proof-only and internal examples already reported. Administrators who cannot accept the risk should prioritize patched kernels from vendors and consider the interim nftables rule as a partial, host-limited filter rather than a complete mitigation.
