Red Hat ships fixes for 9.8-rated Linux TCP flaw CVE-2026-98432; Ubuntu fixes still in testing

Summary

Red Hat has released fixed kernels for RHEL 8, 9, and 10 that address a remotely exploitable use-after-free flaw in the Linux kernel's IPv4 TCP code, tracked as CVE-2026-98432 and rated 9.8. Ubuntu's fixes for its three newest LTS releases are in its opt-in testing channel with no date for a regular update, according to The Hacker News.

What to do

• Install the fixed kernel packages from Red Hat for RHEL 8, 9, and 10 now

• Reboot affected systems to load the patched kernel

• Track Ubuntu's kernel updates and apply them once they leave testing

• Limit network exposure of unpatched systems until fixes are installed

Timeline

1. Nov 3, 2026, 12:01 AM UTCMade public by Mastodon
2. Nov 3, 2026, 12:02 AM UTCFirst seen by cve.now
3. Nov 3, 2026, 12:48 PM UTCConfirmed as CVE-2026-98432

Evidence 3

1. Nov 3, 2026Social
   Mastodon

   “An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5.”

2. Nov 3, 2026Social
   oss-security

   “Re: CVE-2026-98432: init_on_free=1 as an additional interim mitigation”

3. Nov 3, 2026Press
   The Hacker News

   “Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update.”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.