Linux Kernel CVE-2026-98432: Critical TCP Use-After-Free, No RHEL or Ubuntu Fix Yet

Key Points:

• CVE-2026-98432 is a critical race condition vulnerability in the Linux kernel's IPv4 TCP handshake code that can cause use-after-free memory errors, potentially allowing remote attackers to crash systems or leak kernel memory; it affects kernels since version 4.4 and was fixed in various stable releases starting with 5.10.272.
• The vulnerability is scored 9.8 (Critical) by the Linux kernel CVE team due to low attack complexity and no required credentials, but major distributions like Red Hat, Oracle, SUSE, and Amazon rate it lower (7.0 to 8.1) citing the race condition as difficult to exploit; no exploitation in the wild has been reported as of late October 2026.
• Fixed kernel updates have been released by Debian, Oracle Linux, Amazon Linux, and SUSE, while Red Hat and Ubuntu have not yet shipped fixes and list them as deferred or in progress, creating a critical window for users to prepare by identifying vulnerable systems and planning rapid patch deployment.
• Anthropic reported a remote root exploit leveraging this vulnerability on servers with multipath TCP (MPTCP) listeners, involving kernel address leakage and arbitrary code execution, though these claims are unverified and MPTCP is opt-in on Linux; vendors have not confirmed this exploit path or issued mitigations targeting MPTCP.
• Recommended mitigations include patching where fixes exist, inventorying exposed systems especially those with MPTCP listeners, disabling net.ipv4.tcp_migrate_req if not needed, filtering inbound IPv4 options at network edges, and monitoring for kernel crashes, while awaiting fixed kernel releases from Red Hat and Ubuntu.