Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions

CVE-2026-98432 is a Linux kernel vulnerability in the code that creates new IPv4 TCP connections. It is a race condition that can cause a use-after-free, meaning the kernel reads memory after it has already released that memory. The flaw matters because an attacker may be able to turn that memory error into commands running as root.

The bug was introduced in Linux 4.4. It affects Ubuntu, RHEL, and other Linux distributions. The article does not identify every affected kernel version. Paradox says the upstream fix was backported to all maintained stable kernel branches, but users receive it only through their distribution's kernel package.

As of October 29, Ubuntu and RHEL had not released fixed kernels. Debian, Oracle Linux, SUSE, and Amazon Linux had shipped fixes for at least some kernels. Ubuntu and RHEL users should track their vendors' advisories and install the corrected package when available.

The Linux kernel's CVE team rates CVE-2026-98432 at 9.8 out of 10, a critical score. Its assessment assumes an attacker can send specially formed IPv4 TCP requests and repeatedly race the kernel. Under that model, the bug could leak nearby kernel memory, corrupt memory, or crash the system.

Vendors judge the race differently. Red Hat's CVE page gives it 5.9 and says a crash is most likely, with no demonstrated confidentiality or integrity impact. Red Hat's machine-readable advisory, however, gives it 8.1. Oracle and SUSE also use 8.1, while Amazon uses 7.0. The vendors generally rate attack complexity high.

The kernel team calls the complexity low because both sides of the race are attacker-induced. Vendors consider the timing harder to achieve reliably. Paradox's reported exploit strengthens the higher-impact case, but its post does not provide the code, tested kernel version, or configuration.

A successful remote exploit could give an attacker root-level command execution on an affected Linux server. Root is the highest system privilege described in the article's exploit account. That could let the attacker run commands of their choice rather than merely crash the service.

Paradox describes two stages. First, the race causes the kernel to return extra bytes, and one response can reveal a kernel address. That helps defeat KASLR, the kernel's memory-address randomization. Next, the same bug overflows a buffer and replaces a callback pointer with the address of attacker-controlled payload code already placed in kernel memory.

The attack is repeatable because losing one race only fails that connection attempt and does not crash the system, Paradox said. Its test took 48 minutes to leak an address and five more minutes to reach command execution. The post omits the exploit code, kernel version, and configuration tested.

Multipath TCP, or MPTCP, lets one connection use multiple network paths at the same time. On Linux, an application must specifically request MPTCP when opening a socket. It is therefore a feature used by applications that want one connection to span several paths.

Paradox said its exploit works against Linux servers with a multipath TCP listener. The company linked the vulnerability to that configuration in its post describing flaws found and exploited by Paradox. The exploit still relies on the underlying IPv4 TCP race: freed connection options are later read, allowing memory disclosure and corruption.

The connection to MPTCP comes from Paradox's report, not from the formal vulnerability materials. Neither the CVE record nor the kernel fix mentions MPTCP. The article also does not provide the tested kernel version or configuration, so it does not establish a broader configuration requirement beyond Paradox's description.

Debian, Oracle Linux, SUSE, and Amazon Linux had shipped fixed packages for at least some of their kernels by October 29. The upstream fix had also been backported to all maintained stable kernel branches, according to Paradox. Distribution users still need the package supplied by their own vendor.

Ubuntu had listed its cloud, FIPS, and real-time kernels as vulnerable or work in progress. RHEL's fixes were deferred to a future update. Neither Ubuntu nor Red Hat gave a release date. That means an upstream patch alone does not confirm protection on a particular installed system.

Ubuntu and RHEL users should watch their distribution security pages and install the fixed kernel as soon as it becomes available. Until then, they should identify exposed TCP services and follow vendor guidance. The article provides no confirmed workaround, so it does not support claiming that a particular configuration change eliminates the risk.

A race condition occurs when separate CPU threads act on shared data in an unsafe order. Here, the race happens while the kernel completes a new IPv4 TCP connection. The kernel must transfer IP options from the pending connection request to the new socket.

The kernel hands over those options without copying them. If the new socket is destroyed while another CPU is still using the options to answer a resent connection request, the memory holding the options is freed first. The other CPU then reads that released memory. That is a use-after-free bug.

The same timing error can produce different results, including a crash, memory disclosure, or memory corruption. IPv6 does not have this particular race because the kernel copies options for IPv6 connections. The fix makes the kernel wait until other CPUs finish reading the options before freeing them.

The Linux kernel handles TCP connections between applications and the network. It processes handshakes, creates sockets, stores connection options, and coordinates work across CPUs. It also manages the memory used by those operations. Because this code runs inside the kernel, an error can affect the whole system rather than only one application.

For this flaw, the kernel moves IPv4 IP options from a pending request to a new socket. A race can free those options while another CPU still reads them. The resulting use-after-free can expose kernel memory or corrupt nearby data. Paradox said its exploit ultimately overwrote a callback pointer and executed a payload in kernel memory.

Kernel code also operates with the highest system privileges. That is why successful exploitation could run a shell command as root, according to Paradox. The article describes the risk, but it does not list every action a root-level attacker could take. The fix delays freeing memory until other CPUs finish reading it.