Red Hat ships RHEL kernels for critical Linux TCP flaw
Red Hat has released kernel updates for Red Hat Enterprise Linux (RHEL) 8, 9 and 10 to address CVE-2026-98432, a use-after-free vulnerability in the Linux kernel’s IPv4 TCP code. The Linux kernel CVE team rates the issue 9.8 out of 10, and Red Hat has raised its assessment from Moderate, at 5.9, to Critical.
The flaw can be reached remotely without authentication and may lead to remote code execution. Red Hat issued RHSA-2026:93414 for RHEL 8, RHSA-2026:93412 for RHEL 9 and RHSA-2026:93413 for RHEL 10 on November 1. Systems must be rebooted after the updated kernel is installed.
How the TCP race occurs
When a server accepts an IPv4 TCP connection, the kernel passes IP options from the incoming request to the new socket without copying them. If a client retransmits the request while another processor is still reading the options, the kernel can access memory that has already been freed.
The known trigger uses connection requests carrying IPv4 Record Route or Timestamp options and can be sent to any listening TCP port. The bug has existed since Linux 4.4, while the upstream correction landed in October. IPv6 is not affected on the main path described for this vulnerability.
The issue underscores a wider operational concern around host-to-container escalation: Linux container-to-host root escalation risk illustrates how a Linux vulnerability can turn a container foothold into host-level root access, making kernel-update discipline relevant across shared compute environments.
Fixed RHEL versions and Ubuntu status
RHEL 8.10 is fixed in kernel 4.18.0-553.182.1.el8_10, RHEL 9.8 in 5.14.0-687.64.1.el9_8, and RHEL 10.2 in 6.12.0-211.72.1.el10_2. Administrators can compare the running version reported by uname -r with the applicable fixed release after updating and rebooting.
Canonical said fixes for Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS are available through the opt-in -proposed testing pocket rather than the normal update channel. The listed kernels are 5.15.0-203.213 for Jammy, 6.8.0-149.149 for Noble, and 7.0.0-43.43 for Resolute.
Packages in -proposed are not installed automatically. Canonical said it tests kernel updates across more than 2,000 certified servers and devices before regular release, and it provided no release date. Ubuntu 20.04, 18.04 and 16.04 had no fix at the time of the advisory; older releases require Expanded Security Maintenance through Ubuntu Pro.
Mitigation is not a substitute for updates
Red Hat published an nftables rule that drops inbound IPv4 TCP packets with IP options. It blocks the known trigger, but Red Hat cautioned that it cannot fully prevent exploitation and could affect workloads relying on IPv4 options. The rule protects only the host on which it is loaded, and traffic between containers on the same host can bypass it.
Canonical also said that disabling Multipath TCP is not sufficient because the defect lies in the IPv4 TCP path rather than in MPTCP itself. No vendor, CERT or the kernel CVE team had reported exploitation, and the vulnerability was not in CISA’s Known Exploited Vulnerabilities catalog as of October 30. Anthropic reported that an unreleased internal research model created a remote root exploit for Linux servers with an MPTCP listener, but the exploit code has not been published.
For businesses, the practical priority is to inventory Linux hosts with listening TCP services, deploy the vendor-fixed kernel where it is available, reboot, and verify the active version. Where an Ubuntu production fix remains in testing, teams should make a documented risk decision rather than treat a packet filter or MPTCP setting as an equivalent replacement for the security update.