CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP code that can let a remote attacker run code with no login. Red Hat shipped fixed kernels for RHEL 8, 9 and 10 on November 1, Ubuntu has fixes in testing for 22.04, 24.04 and 26.04, and Amazon Linux, Debian and SUSE patched in October. Update the kernel and reboot.
If your company runs Linux servers, cloud VMs or a self-hosted app on a VPS, update the kernel this week and reboot. CVE-2026-98432 is a bug in the kernel’s IPv4 TCP code that can let an attacker on the network run code on the machine with no password and no user action. The Linux kernel CVE team rates it 9.8 out of 10, and Red Hat calls it Critical. Fixed kernels are out for Red Hat Enterprise Linux and Amazon Linux, and Ubuntu’s are in final testing.
What Red Hat and Canonical confirmed
Red Hat’s security bulletin RHSB-2026-016, first published October 30, describes a use-after-free in the IPv4 stack. An unauthenticated remote attacker can hit a race condition while the kernel processes a TCP connection request. Red Hat says exploitation “requires precise timing” but no privileges. It lists RHEL 8, 9 and 10 as affected, plus OpenShift and products built on the RHEL kernel, such as RHEL CoreOS and OpenStack Platform.
Red Hat shipped the fixes on November 1. The RHEL 9 update, RHSA-2026:93412, installs kernel 5.14.0-687.64.1.el9_8 and says the system must be rebooted. According to The Hacker News, the matching RHEL 8.10 and 10.2 updates are RHSA-2026:93414 and RHSA-2026:93413.
Canonical’s November 2 post says fixed kernels are in the -proposed pocket for three LTS releases. They move to regular updates once testing on more than 2,000 certified machines is done. Ubuntu’s security team calls updating “the only appropriate mitigation.”
Which kernel you need
| Distribution | Fixed kernel | Status on November 3 |
|---|---|---|
| RHEL 10.2 | 6.12.0-211.72.1.el10_2 | Released |
| RHEL 9.8 | 5.14.0-687.64.1.el9_8 | Released |
| RHEL 8.10 | 4.18.0-553.182.1.el8_10 | Released |
| Ubuntu 26.04 LTS | 7.0.0-43.43 | In -proposed |
| Ubuntu 24.04 LTS | 6.8.0-149.149 | In -proposed |
| Ubuntu 22.04 LTS | 5.15.0-203.213 | In -proposed |
| Ubuntu 20.04, 18.04, 16.04 | None yet | Pending |
The Hacker News also reports that Amazon Linux shipped fixes between October 24 and 30, and that Debian, Oracle Linux and SUSE patched in October. Run uname -r to see which kernel a machine is running now.
Who found it and what is known about attacks
The bug has been in the kernel since Linux 4.4, according to The Hacker News. It reports that an unreleased Anthropic research model wrote a working remote root exploit, which Anthropic disclosed on October 27 and has not published. Public proof-of-concept code on GitHub detects the race but does not run code. No vendor or CERT had reported attacks as of November 3, and CISA had not added the CVE to its Known Exploited Vulnerabilities catalog.
What to do this week
- Patch and reboot. On RHEL, install the November 1 kernel update and reboot. On Amazon Linux, Debian, Oracle Linux and SUSE, install the October kernel updates and reboot. A kernel update does nothing until the machine restarts.
- Ubuntu 22.04, 24.04 or 26.04. Internet-facing servers can take the kernel from -proposed now using Canonical’s steps, or wait for the regular update. Watch for it and reboot when it lands.
- Older Ubuntu. 20.04, 18.04 and 16.04 have no fix yet. Keep those machines off the open internet where you can, and plan the upgrade.
- If you cannot reboot yet. Red Hat published an nftables rule that drops incoming IPv4 TCP packets carrying IP options. It says filtering “is not a substitute for patching,” and the rule can break workloads that rely on IP options. Test it first.
- Managed hosting. If you run on a VPS or managed Kubernetes, check your provider’s status page for when it rebooted hosts and nodes. Your own VM kernel is still yours to update.
A kernel bug turns every small cloud server into a reboot task
Most remote teams now run something on Linux: a staging box, a self-hosted Git or wiki, a database VM. Those machines tend to sit for months without a reboot, so a kernel fix that needs one often never gets applied. This flaw needs no login and lives in the code that accepts new connections, which every server exposes. The cost of acting is a scheduled restart. The same habit protects the rest of the office network, where unpatched Synology NAS boxes are being hit by ransomware this week.