A use-after-free flaw in the Linux kernel's IPv4 TCP code, CVE-2026-98432, can let a remote attacker who has not authenticated run code on the server. The kernel's CVE team rates it 9.8 out of 10. Red Hat, which first rated it moderate, has raised it to critical. The bug has been present since Linux 4.4, and the upstream fix landed in October. IPv6 is not affected on the main path.
Red Hat released fixed kernels for RHEL 8, 9 and 10 on November 1, and a reboot is needed after installation. Canonical said on November 2 that fixes for Ubuntu 22.04, 24.04 and 26.04 LTS are in its proposed pocket, a testing channel that does not install automatically, with no date for a regular release. Versions 20.04 and older have no fix yet. Debian, Oracle Linux, SUSE and Amazon Linux shipped fixes in October.
No exploitation in the wild has been reported, and the flaw was not listed in CISA's Known Exploited Vulnerabilities catalog. Anthropic said on October 27 that an internal research model of its own wrote an exploit that reaches root, and it has not published it. What to do: update the kernel and reboot. Red Hat also published a temporary firewall rule, but says it does not fully block exploitation, and Canonical says updating is the only appropriate mitigation.