Back

Red Hat Patches Linux TCP Flaw as Ubuntu Tests LTS Fixes

lite News Desk 2 min read

Red Hat released fixes for Linux kernel vulnerability CVE-2026-98432 for RHEL 8, 9 and 10 on November 1, 2026. Canonical said on November 2 that updates for three Ubuntu LTS releases remained in testing. Red Hat’s bulletin classifies the IPv4 networking flaw as critical and says it may allow an unauthenticated attacker to execute code remotely.

According to Red Hat, exploitation requires precise timing of a race during TCP connection processing, but neither user interaction nor existing privileges is necessary. Its RHEL assessment gives the vulnerability a CVSS 3.1 score of 9.8 and a Critical impact rating. That rating measures the vulnerability’s severity, rather than establishing that any particular system has been compromised.

Red Hat describes socket-option data for an incoming IPv4 TCP request being freed before another operation finishes reading it. That overlapping operation can involve socket migration or a retransmitted request. Canonical lists the flaw in Linux kernels from version 4.4 onward, without establishing that every distribution or system is affected.

Amazon Web Services said specially constructed IPv4 TCP traffic containing IP options can trigger the flaw when directed at an affected listening port. Its bulletin described a research demonstration of unauthenticated remote code execution on hosts with a Multipath TCP (MPTCP) listener, but said AWS had no evidence of exploitation when the bulletin was updated. Both Canonical and Red Hat say MPTCP is not necessary; according to Red Hat, RHEL’s default setting disabling MPTCP does not remove the vulnerability.

The RHEL updates carry errata identifiers RHSA-2026:93414 for RHEL 8, RHSA-2026:93412 for RHEL 9 and RHSA-2026:93413 for RHEL 10. The specified corrected kernels are 4.18.0-553.182.1.el8_10 for RHEL 8.10, 5.14.0-687.64.1.el9_8 for RHEL 9.8 and 6.12.0-211.72.1.el10_2 for RHEL 10.2.

For Ubuntu, Canonical’s November 2 status placed kernel 5.15.0-203.213 for 22.04 LTS, 6.8.0-149.149 for 24.04 LTS and 7.0.0-43.43 for 26.04 LTS in the opt-in -proposed archive pocket. Those packages were undergoing qualification testing and are not included in upgrades by default. Canonical said testing covered more than 2,000 certified servers and devices, with transfer to the regular updates pocket planned after testing finishes. It supplied no release date in that post.

Separately, Canonical’s table marked Ubuntu 26.10 as fixed with kernel 7.3.0-10.10. Updates for Ubuntu 20.04, 18.04 and 16.04 remained pending in the November 2 status.

As an interim measure, Red Hat says blocking incoming IPv4 TCP traffic containing IP options can limit exposure, but does not replace a kernel patch. The company says filtering may interrupt workloads and must be reapplied after a reboot to remain active. Canonical says installation of its kernel security update must be followed by a reboot.

* This article is based on publicly available information at the time of writing.

More from Cybersecurity

  1. The NCSC says attackers are likely to use AI to target known flaws in older infrastructure technology by 2028.

  2. Binance said its zero-knowledge proof for ten tokens was expected by November 3, with checks showing backing of at least 1:1.

  3. Binance said it had replenished about 90% of the affected assets by October 31, with its treasury and user fund covering the losses.

  4. Drupal recommends updating Commerce Core to a fixed release and reviewing orders for inconsistencies.

  5. Apple says the reported exploitation was extremely sophisticated and involved selected targets using iOS versions earlier than iOS 27.