Red Hat Patches Critical Linux TCP RCE Flaw CVE-2026-98432
Original title: Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing
Red Hat released fixed kernels for RHEL 8, 9 and 10 while Ubuntu keeps updates in testing channel.
A use-after-free vulnerability in the Linux kernel's IPv4 TCP code (CVE-2026-98432) can be triggered by unauthenticated remote attackers and leads to remote code execution. Red Hat raised its severity rating to 9.8 Critical and shipped RHSA-2026:93414, RHSA-2026:93412 and RHSA-2026:93413 for RHEL 8.10, 9.8 and 10.2 respectively. Ubuntu fixes for 22.04 LTS, 24.04 LTS and 26.04 LTS remain in the -proposed testing pocket.
Unconfirmed: No known exploitation; Ubuntu release date for regular channel is pending
- CVSS score is 9.8 Critical
- Fixed kernel versions are 4.18.0-553.182.1.el8_10, 5.14.0-687.64.1.el9_8 and 6.12.0-211.72.1.el10_2
- Interim mitigation is nftables rule dropping IPv4 TCP packets with IP options
Impact: remote code execution
- 1.Upgrade to fixed kernel versions
- 2.Apply interim nftables rule if required
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×25 |
From the original article
4 min read at thehackernews.com
Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.