Red Hat has shipped fixed kernel packages for Red Hat Enterprise Linux 8, 9, and 10 addressing a critical use-after-free vulnerability in the Linux kernel’s IPv4 TCP handling code. The flaw, tracked as CVE-2026-98432, carries a severity rating of 9.8 and can reportedly be triggered by a remote, unauthenticated attacker.

Use-after-free bugs in kernel networking code are especially dangerous because they can be reached simply by sending crafted network traffic to a vulnerable host, with no login or local access required. A successful exploit of this class of flaw in the TCP stack can lead to memory corruption, potentially enabling remote code execution or a denial of service against affected systems.

Patch Status Varies by Distribution

Red Hat has already made corrected kernels available for RHEL 8, 9, and 10, giving administrators a direct path to remediation through standard update channels.

Ubuntu’s situation is less settled. Fixes for the distribution’s three newest long-term-support releases exist, but they remain confined to Ubuntu’s opt-in testing (proposed) channel rather than being pushed out through the regular, stable update stream. No timeline has been given for when the patched kernel will graduate to general availability.

What Administrators Should Do

  • Apply the updated kernel packages on RHEL 8, 9, and 10 systems as soon as possible given the critical severity and remote, unauthenticated attack vector.
  • Ubuntu users who need protection sooner can opt into the proposed/testing repository to obtain the fix ahead of its general release, weighing the stability risks of pre-release packages.
  • Where immediate patching is not feasible, consider network-level mitigations such as restricting exposure of affected TCP services until updates can be applied.
  • Monitor vendor advisories for the official stable release of the Ubuntu fix and prioritize it once available.

Given the flaw’s high severity score and the fact that it requires no authentication to exploit, organizations running Linux kernels on internet-facing or otherwise reachable network segments should treat this as a priority patching item.