# CVE-2026-98432: Linux Kernel IPv4 TCP RCE Flaw Patched

> Red Hat has patched CVE-2026-98432, a 9.8-rated use-after-free flaw in the Linux kernel's IPv4 TCP, enabling unauthenticated remote code execution.

- Published: 2026-11-03T15:38:00.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: Linux Kernel, RCE, CVE-2026-98432, Red Hat, Ubuntu
- CVEs: CVE-2026-98432 (CVSS 9.8)
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html
- Canonical: https://runtimerebel.com/blog/cve-2026-98432-linux-kernel-ipv4-tcp-rce-flaw-patched

## Key points

- Unauthenticated remote attackers can execute code on vulnerable Linux systems via IPv4 TCP connections.
- Linux kernel 4.4+, RHEL 8, 9, 10, and specific Ubuntu LTS versions, particularly IPv4 TCP, are affected.
- Apply the latest security kernel updates from Red Hat, Canonical, or other Linux distributors immediately.

## Overview of [CVE](/glossary#cve)-2026-98432: Linux Kernel IPv4 TCP [RCE](/glossary#rce)

Runtime Rebel is issuing an advisory regarding [CVE-2026-98432](https://nvd.nist.gov/vuln/detail/CVE-2026-98432), a critical [use-after-free](/glossary#use-after-free) [vulnerability](/glossary#vulnerability) discovered in the Linux kernel's IPv4 TCP code. This flaw carries a [CVSS](/glossary#cvss) score of 9.8 and allows a remote, unauthenticated attacker to achieve remote code execution (RCE). While no confirmed in-the-wild exploitation has been reported by vendors or CERT teams, the severity of the vulnerability and the existence of a demonstrated proof-of-concept (PoC) by Anthropic underscore the urgent need for patching, particularly for systems exposed to untrusted networks.

This vulnerability affects Linux kernels version 4.4 and later, impacting a wide range of distributions including Red Hat Enterprise Linux (RHEL) and various Ubuntu Long Term Support (LTS) releases. The issue stems from improper handling of IPv4 TCP options during connection establishment, creating a [race condition](/glossary#race-condition) that can lead to memory corruption and subsequent RCE. Organizations are strongly advised to prioritize applying the latest security updates to safeguard their Linux infrastructure.

## Technical Details and [Attack Vector](/glossary#attack-vector)

The core of [CVE-2026-98432](https://nvd.nist.gov/vuln/detail/CVE-2026-98432) lies in how the Linux kernel processes IPv4 TCP options during the connection handshake. Specifically, when a server accepts an IPv4 TCP connection, the kernel passes IP options from the incoming request to the new socket without copying them. If a client retransmits its connection request while another processor is still actively reading these options, a use-after-free condition can occur. This means the kernel attempts to access memory that has already been deallocated, leading to instability, potential crashes, or, in the worst-case scenario, arbitrary code execution.

An attacker can trigger this race condition by sending specially crafted connection requests that include IPv4 Record Route or Timestamp options to any listening TCP port on a vulnerable system. No prior authentication or user interaction is required, making this a highly accessible attack vector for remote threat actors. While IPv6 is generally not affected through the main execution path, the widespread deployment of IPv4 across enterprise and cloud environments makes this a significant concern. The vulnerability has been present since Linux kernel 4.4, with the upstream fix landing in October, highlighting its long-standing presence in the ecosystem, according to [The Hacker News](https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html).

Anthropic has publicly stated that an internal research model successfully developed a remote root [exploit](/glossary#exploit) for this flaw, achieving a root shell on Linux servers with an MPTCP listener. This internal demonstration, while not publicly released, confirms the exploitability of the use-after-free for RCE. Additionally, proof-only code capable of triggering the race condition and detecting echoed freed memory has appeared on GitHub, though this code does not implement full code execution.

## Patching CVE-2026-98432 on Red Hat Enterprise Linux and Ubuntu

Timely application of vendor-provided patches is the only complete and reliable mitigation for this vulnerability.

### Red Hat Enterprise Linux Remediation

Red Hat has released specific security advisories and updated kernel packages for its supported versions:

*   **RHEL 8**: RHSA-2026:93414
*   **RHEL 9**: RHSA-2026:93412
*   **RHEL 10**: RHSA-2026:93413

These updates were shipped on November 1st. Administrators managing Red Hat systems should apply these updates immediately. A system reboot is required after installing the kernel updates to ensure the patched kernel is in effect. For those researching how to [patch](/glossary#patch) CVE-2026-98432 on Red Hat Enterprise Linux, this information is critical.

### Ubuntu CVE-2026-98432 Updates

Canonical has also addressed the vulnerability, but the release schedule differs:

*   Fixes for **Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS** are currently available in the `-proposed` pocket. This is an opt-in testing channel, and packages from here do not install automatically.
*   Canonical performs extensive testing before releasing updates to the regular channel, and a firm release date has not yet been provided for general availability.
*   Administrators who require immediate remediation for Ubuntu systems and are willing to accept the risks associated with testing channels can enable `-proposed` and install the kernel update manually.
*   **Ubuntu 20.04 LTS, 18.04 LTS, and 16.04 LTS** do not yet have specific fixes mentioned for this vulnerability. Users of these older releases typically require Expanded Security Maintenance (ESM) through Ubuntu Pro for ongoing security support.

### Other Distributions

Debian, Oracle Linux, and SUSE all shipped fixes in October, while Amazon Linux also patched the flaw across its packages between October 24th and 30th. Organizations running these distributions should ensure their systems are fully updated.

## Interim Mitigations and Important Considerations

While patching is the definitive solution, Red Hat published an `nftables` rule on October 30th designed to drop inbound IPv4 TCP packets containing IP options. This rule blocks the *known trigger* for the race condition, providing a temporary partial defense. However, Red Hat explicitly stated that this rule *cannot fully prevent exploitation* and *may break workloads* that legitimately depend on IPv4 options. Furthermore, this filter applies only to the host where it is loaded and will not protect against traffic between containers on the same host. For a comprehensive mitigation for Linux kernel IPv4 TCP RCE, security updates are paramount.

It is also important to note that advice circulating to disable Multipath TCP (MPTCP) as a workaround is not sufficient. Canonical has clarified that the flaw resides in the IPv4 TCP path itself, not specifically in MPTCP, and that disabling MPTCP alone will not prevent exploitation. The Ubuntu Security Team maintains that "security updates are the only appropriate mitigation."

Defenders should regularly compare the output of `uname -r` against vendor-provided patched kernel versions to verify system status. Given the high severity and potential for remote, unauthenticated compromise, organizations should treat this vulnerability with urgency and implement comprehensive patching strategies across their Linux server fleet.

**Related:** [CVE-2026-64638: WordPress Pre-Auth XSS Leads to PHP RCE](/blog/cve-2026-64638-wordpress-pre-auth-xss-leads-to-php-rce), [Zero-Day Exploitation: StyleSmuggler RCE in Magento, Adobe Commerce](/blog/zero-day-exploitation-stylesmuggler-rce-in-magento-adobe-commerce)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2026-98432-linux-kernel-ipv4-tcp-rce-flaw-patched