# SZB-ea53f56723: Red Hat ships fixes for 9.8-rated Linux TCP flaw CVE-2026-98432; Ubuntu fixes still in testing

Red Hat has released fixed kernels for RHEL 8, 9, and 10 that address a remotely exploitable use-after-free flaw in the Linux kernel's IPv4 TCP code, tracked as CVE-2026-98432 and rated 9.8.

- Type: Early warning
- Kind: Vulnerability
- Vendor: Linux kernel
- Product: ENE UB6250 reader driver
- Status: Confirmed
- Sources: 3 distinct
- First seen: 2026-11-03 00:02 UTC
- Confirmed: 2026-11-03 12:48 UTC

Written by a model from the sources below. Verify against them.

## Summary

Red Hat has released fixed kernels for RHEL 8, 9, and 10 that address a remotely exploitable use-after-free flaw in the Linux kernel's IPv4 TCP code, tracked as CVE-2026-98432 and rated 9.8. Ubuntu's fixes for its three newest LTS releases are in its opt-in testing channel with no date for a regular update, according to The Hacker News.

## What to do

- Install the fixed kernel packages from Red Hat for RHEL 8, 9, and 10 now
- Reboot affected systems to load the patched kernel
- Track Ubuntu's kernel updates and apply them once they leave testing
- Limit network exposure of unpatched systems until fixes are installed

## Timeline

- 2026-11-03 00:01 UTC: Made public by Mastodon
- 2026-11-03 00:02 UTC: First seen by cve.now
- 2026-11-03 12:48 UTC: Confirmed as CVE-2026-98432

## Evidence (3 sources)

- 2026-11-03 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117549568469231106): “An issue was discovered in drivers/usb/storage/ene\_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5.”
- 2026-11-03 · Social · [oss-security](https://seclists.org/oss-sec/2026/q4/476): “Re: CVE-2026-98432: init\_on\_free=1 as an additional interim mitigation”
- 2026-11-03 · Press · [The Hacker News](https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html): “Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-ea53f56723&body=https%3A%2F%2Fcve.now%2FSZB-ea53f56723%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-ea53f56723

### Has Linux kernel confirmed it?

Yes. Confirmed as CVE-2026-98432.

Source: https://mastodon.social/@EUVD_Bot/117549568469231106, https://seclists.org/oss-sec/2026/q4/476, https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html

### What should Linux kernel users do?

Install the fixed kernel packages from Red Hat for RHEL 8, 9, and 10 now. Reboot affected systems to load the patched kernel. Track Ubuntu's kernel updates and apply them once they leave testing. Limit network exposure of unpatched systems until fixes are installed.

### Does it have a CVE?

Yes. It is tracked as CVE-2026-98432.

Source: https://cve.now/CVE-2026-98432

## Tracked as

- [CVE-2026-98432](https://cve.now/CVE-2026-98432.md)

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-ea53f56723
Site guide for agents: https://cve.now/llms.txt