Red Hat Ships Fixes for 9.8-Rated Linux TCP Flaw While Ubuntu Patches Sit in Testing Channel

Since the Linux kernel CVE team published CVE-2026-98432 on Oct. 15, the story has shifted from "who is patched" to "who isn't": Red Hat shipped fixed kernels on Nov. 1, while Ubuntu's fixes remain in testing as of Nov. 2.

The flaw is a use-after-free race in the kernel's IPv4 TCP handshake code. The kernel CVE team scored it 9.8 out of 10 on Oct. 24. It is reachable over the network with no credentials and no user interaction, and the bug dates to Linux 4.4.

What changed this week

Red Hat released RHSA-2026:93414 for RHEL 8, RHSA-2026:93412 for RHEL 9 and RHSA-2026:93413 for RHEL 10 on Nov. 1. A reboot is required after installing. Red Hat also shipped RHSA-2026:93415 for the RHEL 8 real-time kernel.

Red Hat had initially rated the flaw lower. It now lists it as Critical at 9.8, matching the kernel team's score.

Not everything is covered. The RHEL 9 real-time kernel and OpenShift 4 are still listed as affected. AlmaLinux 8 and CloudLinux 8 have rebuilt the fix. AlmaLinux 9 and 10, CloudLinux 9 and 10, and Rocky Linux have not shipped it yet.

Debian, Oracle Linux, Amazon Linux and SUSE have fixed kernels for at least some releases.

Ubuntu is the gap

Canonical said on Nov. 2 that fixes for Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS are in its -proposed pocket. That is an opt-in testing channel, so packages there do not install automatically. Administrators who cannot wait can enable it and pull the kernel manually.

Canonical tests kernel updates on more than 2,000 certified servers and devices before moving them to the regular channel. It has given no release date.

Ubuntu 20.04, 18.04 and 16.04 have no fix. Those releases need Expanded Security Maintenance through Ubuntu Pro. Canonical's post covers only the generic kernel. Cloud, FIPS and real-time variants are listed as work in progress.

How the bug works

When a server accepts an IPv4 TCP connection, the kernel hands the IP options stored with the pending request to the new socket without copying them. If the client retransmits its request while another CPU is still reading those options, the memory can be freed underneath it.

An attacker triggers the race by sending connection requests carrying IPv4 Record Route or Timestamp options to a listening TCP port. IPv6 is not affected by the main race because the kernel copies the options on that path.

Eric Dumazet wrote the fix on Oct. 1 and it was applied upstream on Oct. 5, ten days before the CVE went public. It is in every maintained stable branch and in Linux 7.3. The commit credits Anthropic researcher Xinyang Ge with reporting the bug.

The Anthropic exploit claim

On Oct. 27, Anthropic's Frontier Red Team said an unreleased internal Claude research model wrote a working remote root exploit for the flaw. According to Anthropic, the attack runs in two stages. First it leaks a kernel address to defeat KASLR, then it overwrites a callback pointer to run a shell command as root.

Anthropic's post puts the pointer leak at 48 minutes and command execution at another five. A lost race only fails the handshake rather than crashing the machine, so an attacker can keep retrying.

Anthropic has not published the exploit code, the kernel version or the tested configuration. Security firm TuxCare said no independent public reproduction had turned up as of Oct. 30.

The exploit as described needs a Multipath TCP listener. The Go Security Team has warned that programs built with Go 1.24 or later enable MPTCP on listening sockets by default, so an administrator may be running one without knowing. RHEL 8, 9 and 10 ship with MPTCP switched off, per CIQ's testing.

The Go team also says systems without an MPTCP listener may be vulnerable to similar attacks. The underlying flaw is not limited to MPTCP.

Severity is disputed

Not every vendor agrees on the score. Oracle, SUSE and Amazon rate the flaw 8.1 rather than 9.8, on the grounds that the race is hard to win.

No vendor, CERT or the kernel CVE team has reported exploitation in the wild. As of Nov. 2, the CVE is not in CISA's Known Exploited Vulnerabilities catalog. Some security vendor posts describe the flaw as under active attack, but no official source has confirmed that.

Mitigation for unpatched hosts

Red Hat published an nftables rule on Oct. 30 that drops inbound IPv4 TCP packets carrying IP options, detailed in bulletin RHSB-2026-016. Red Hat says it blocks the known trigger but cannot fully prevent exploitation, and it may break workloads that depend on IPv4 options.

Administrators can check for MPTCP listeners with the command ss -H -lMn. Each line it prints is one. Restricting exposed services to trusted networks is the other step Red Hat points to.

On RHEL, the fix installs with sudo dnf update kernel followed by a reboot. Admins can confirm it by comparing uname -r against the version in the advisory.

Ubuntu's timeline remains unclear. Canonical has not said when the testing-channel kernels will reach the regular update channel, and the older releases have no fix in preparation.