Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

Red Hat patched the Linux kernel flaw in Red Hat Enterprise Linux 8, 9, and 10. It published RHSA-2026:93414 for RHEL 8, RHSA-2026:93412 for RHEL 9, and RHSA-2026:93413 for RHEL 10 on November 1. Systems need a reboot after installing the updates.

Ubuntu has fixes for Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS, but they remain in the -proposed pocket. This is an opt-in testing channel, so those packages do not install automatically through the regular update process.

Canonical has not provided a release date for the normal channel. It tests kernel updates across more than 2,000 certified servers and devices before wider release. Administrators needing the fix sooner can enable -proposed, install the kernel update, and reboot, but testing-channel packages require extra care.

A use-after-free vulnerability occurs when software releases a piece of memory but later continues using it. The freed memory may have been reused for something else, causing a crash, corrupted data, or potentially attacker-controlled behavior.

Here, accepting an IPv4 TCP connection causes the kernel to pass IP options from the incoming request to the new socket without copying them. If the client retransmits its connection request while another processor is still reading those options, the original memory can be freed too soon. The reader then accesses invalid memory.

The flaw affects the IPv4 TCP path and has existed since Linux 4.4. An attacker needs no login. Sending connection requests with IPv4 Record Route or Timestamp options can trigger the timing problem. The upstream fix landed in October, and vendors are distributing patched kernels.

CVE-2026-98432 is considered highly serious because it can be reached remotely without authentication and may allow remote code execution. The Linux kernel's CVE team gives it a CVSS score of 9.8 out of 10, which places it near the top of the standard severity scale.

The score signals that an attack can be launched over a network, requires no login, and could have severe consequences for a vulnerable server. The article does not describe the score as proof that every system will be compromised, but it indicates urgent patching priority.

Red Hat first rated the vulnerability Moderate at 5.9. It later raised the score to 9.8 and classified the issue as Critical. Amazon Linux rated it 8.1 and Important, emphasizing crashes and possible memory corruption. Debian, Oracle Linux, and SUSE shipped fixes in October.

The attacker sends IPv4 TCP connection requests carrying Record Route or Timestamp options. The requests can target any listening TCP port. No credentials or user interaction are needed, making exposed servers potential targets even when the attacker has no account.

The trigger depends on timing. If the client retransmits a connection request while another processor is reading the request's IP options, the kernel may read memory that has already been freed. That use-after-free can cause a crash or memory corruption. The article reports that remote code execution is possible, although public proof-only code does not implement execution.

Paradox said an unreleased internal Paradox research model produced a remote root exploit for Linux servers with an MPTCP listener. Its proof of concept needed 48 minutes to leak a kernel address and five more minutes to reach a root shell. No attacks have been reported by vendors or CERTs.

The nftables rule blocks inbound IPv4 TCP packets whose headers contain options. It targets the known trigger for the race, but Red Hat warns that it cannot fully prevent exploitation and may disrupt workloads using IPv4 options. It also applies only where loaded, and container traffic can bypass it.

Installing Ubuntu's proposed kernel applies the vendor's code fix to the vulnerable kernel. It requires enabling the -proposed channel, installing the update, and rebooting. This is a security update, although Canonical is still testing it before regular release. It is therefore more direct than filtering suspected trigger traffic.

Disabling Multipath TCP removes one possible listening configuration, but it does not fix the IPv4 TCP flaw. Canonical says that advice alone is insufficient. The Ubuntu Security Team considers security updates the only appropriate mitigation, so the three actions are not equivalent.

The vulnerability has been present since Linux 4.4 because the IPv4 TCP code retained the unsafe handling of connection options across many kernel versions. The upstream project only landed a corrective change in October. That common history explains why multiple distributions needed fixes for related kernels.

Distributors do not publish updates simultaneously. Each must adapt the upstream change to supported products, build packages, test different kernel variants, and verify that the update does not break systems. Red Hat released fixes for RHEL 8, 9, and 10 on November 1. Debian, Oracle Linux, and SUSE shipped fixes in October.

Ubuntu's generic fixes are still in -proposed for versions 22.04, 24.04, and 26.04 LTS. Canonical tests updates across more than 2,000 certified servers and devices before regular release. Older Ubuntu versions still have no fix, while cloud, FIPS, and real-time variants remain work in progress.

TCP is the networking system that establishes and manages connections between computers. The operating-system kernel handles those connections, stores their state, and processes incoming packets. On a modern machine, different processors can work on related network tasks at the same time.

In this vulnerability, the kernel accepts an IPv4 TCP connection and passes the request's IP options to the new socket without copying them. A retransmitted request can cause that option data to be freed while another processor is still reading it. The result depends on timing, which is why it is called a race condition.

The unsafe access can produce a crash, memory corruption, or potentially remote code execution. IPv4 Record Route and Timestamp options provide the known trigger. IPv6 is not affected on the main path. A kernel fix changes the handling so the race cannot use freed option memory in the same way.