Red Hat ships TCP kernel fixes as Ubuntu LTS patches stay in testing

Red Hat released fixed kernels for CVE-2026-98432 on Nov. 1, 2026, covering Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu’s patches for 22.04 LTS, 24.04 LTS, and 26.04 LTS remain in the opt-in -proposed testing channel without a date for the regular update.

The Linux kernel CVE team issued CVE-2026-98432 on Oct. 15, 2026, and rated it 9.8 on CVSS 3.1. The flaw is a use-after-free in the Linux kernel IPv4 TCP stack, and the bug has existed since Linux 4.4. The vector is network, with no privileges and no user interaction required.

A remote attacker who is not authenticated can run code without logging in or interacting with the system. An attacker triggers the race by sending connection requests that carry IPv4 Record Route or Timestamp options to an open TCP port, while the main IPv6 path stays unaffected. Code released on GitHub demonstrates the race and detects freed memory in a SYN-ACK (a TCP packet that acknowledges an incoming connection request), but the proof-of-concept does not carry out code execution.

Anthropic said on Oct. 27, 2026, that an unreleased internal Claude research model produced a remote root exploit against Linux servers with an MPTCP listener, requiring no credentials or user interaction. Anthropic’s proof of concept spent 48 minutes exposing a kernel address before taking another 5 minutes to obtain a root shell, and the company has not released the exploit code.

Neither a vendor, CERT, nor the kernel CVE team has reported attacks that exploit this flaw, and CISA’s Known Exploited Vulnerabilities catalog from Oct. 30, 2026, left it off the list. AWS also states it has seen no evidence that anyone leveraged the issue.

Red Hat initially rated the issue Moderate at 5.9, then raised it to 9.8 and classified it as Critical. On Nov. 1, 2026, Red Hat shipped RHSA-2026:93414 for RHEL 8, RHSA-2026:93412 for RHEL 9, and RHSA-2026:93413 for RHEL 10, and the fix takes effect only after a reboot.

Canonical stated on Nov. 2, 2026, that -proposed packages do not install by themselves and that its team checks kernel updates across more than 2,000 certified servers and devices before promoting them. The Ubuntu Security Team views security updates as the only appropriate fix, and it warned that turning off MPTCP by itself does not suffice because the bug sits in the IPv4 TCP path rather than in MPTCP. Versions 20.04, 18.04, and 16.04 still lack a fix, and older releases need Expanded Security Maintenance through Ubuntu Pro.

Red Hat issued an nftables rule on Oct. 30, 2026, to drop inbound IPv4 TCP packets that carry IP options. The rule blocks the known trigger yet cannot fully stop exploitation and may break workloads that depend on IPv4 options. A CIQ kernel team member said the nftables filter protects only the host where it runs, and container traffic inside that host can slip past it.

Some advisers have proposed turning off MPTCP as a workaround, yet the Go Security Team warned that the flaw is not confined to MPTCP. CIQ testing found that plain TCP listeners still respond to SYNs with Record Route options even when MPTCP is off. Go 1.24 turns on MPTCP automatically for Linux listening sockets, so listeners stay exposed even when the operator never enabled it.

The upstream patch arrived in early October 2026 in Linux 7.3-rc7, and stable branches including 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, and 7.2.10 received backports. The fix commit is e3f33b0a. Amazon Linux scored the vulnerability 8.1 and rated it Important, saying the main impact is a crash that may involve memory corruption. Debian, Oracle Linux, and SUSE shipped fixes in October, while Amazon Linux updated all packages from Oct. 24 through Oct. 30, 2026.

AlmaLinux placed patched kernels for versions 8, 9, and 10 in its testing repository on Oct. 30, 2026, though a move to production has not been confirmed. RHEL 6 and 7 are not listed as affected in Red Hat’s bulletin. Red Hat’s bulletin covers OpenShift as potentially affected, but the four advisories confirmed do not include OpenShift or other RHEL 9 EUS release dates.

AWS issued security bulletin 2026-160-AWS on Oct. 30, 2026, saying it has seen no evidence that anyone exploited the issue, and AWS said the complete fix requires a kernel update and a reboot. Kernel packages for Amazon Linux 2 and Amazon Linux 2023 are available, and EKS-optimized AMIs release v20261031 to address the issue. The Amazon EKS Auto Mode AMIs came out on Oct. 31, 2026.

The AWS RDS and Aurora database OS patch arrives Nov. 3, 2026, and the Redshift cluster OS patch lands on Nov. 2, 2026. AWS notes that customers must keep database ports off the internet. Since Kubernetes nodes share the host kernel, rebuilding container images will not apply the fix; the node operating system must receive the patch.

Severity assessments differ: the kernel CNA gives 9.8 under CVSS 3.1, Ubuntu’s page also lists a CVSS 4.0 score of 8.3, and Red Hat rates the impact Critical. It remains unresolved whether attackers can exploit systems without MPTCP listeners the same way; Anthropic only demonstrated the MPTCP case, while the Go team said similar attacks might work even on systems with no MPTCP listeners.

Fixed kernels from Red Hat are available, whereas Ubuntu’s LTS fixes remain in testing, so a patch availability gap leaves many enterprise servers exposed. “A kernel update and reboot is the only complete remediation for this issue,” AWS said.