Red Hat raised its rating on CVE-2026-98432 from Moderate to Critical and published kernels for Enterprise Linux 8, 9 and 10 on November 1. Canonical’s fixes for its three newest long-term releases are still in testing with no release date.
The gap matters because of who can reach the bug. Nothing is required but a connection attempt.
The bug lives in IP option handling
When a server takes an IPv4 TCP connection, the kernel hands the incoming IP options to the new socket without duplicating them. If the client retransmits while another processor is still reading that memory, the kernel can touch a block it has already released. Sending connection requests with Record Route or Timestamp options to any listening port is enough to start the race.
The kernel’s own CVE team rates it 9.8. The flaw has existed since Linux 4.4, and the upstream repair landed in October.
Two patch paths, one uneven
Red Hat shipped RHSA-2026:93414, RHSA-2026:93412 and RHSA-2026:93413, and each requires a reboot before the fix takes effect. Administrators can confirm the running kernel against the published versions rather than assuming a package install changed what is loaded.
Ubuntu 22.04, 24.04 and 26.04 have patched kernels in the proposed pocket, a channel that does not install automatically because Canonical tests against more than 2,000 certified machines first. Ubuntu 20.04, 18.04 and 16.04 have nothing yet and need Ubuntu Pro’s extended maintenance. Hosts that cannot wait should either enable the proposed pocket deliberately or restrict exposed services.
