Linux TCP flaw CVE-2026-98432: Debian fixed, Ubuntu and RHEL waiting

Linux TCP flaw CVE-2026-98432: Debian fixed, Ubuntu and RHEL waiting

29 October 2026: CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP code, present since Linux 4.4, which the kernel's own CVE team scores 9.8. Upstream fixed it on 5 October and Debian has shipped patched kernels, but as of 29 October Ubuntu listed its fixes as in progress and Red Hat had deferred its fix to a future update, so most Ubuntu and RHEL servers are still exposed.

Not yet independently verified. Not yet independently verified. The Debian and Ubuntu statuses are from their own trackers, read on 30 October; the Red Hat, Amazon, Oracle and SUSE details and the exploit account come from The Hacker News's reading of those vendors' pages and of the researchers' post, which we have not opened. We will update this when it can be confirmed, and remove this note.

How the race works

When a TCP connection completes its handshake, the kernel hands the IP options held by the half-open request over to the new child socket without copying them. Another CPU can at the same moment be answering a retransmitted SYN for the same request, building a SYNACK from those options. Nothing stops the child socket from being freed in the meantime, and it frees the options at once rather than after an RCU grace period, so the SYNACK code can read freed memory. The same pattern exists when request sockets are migrated between listeners (with net.ipv4.tcp_migrate_req set to 1, or a BPF reuseport program that migrates). The fix, upstream commit e3f33b0a1d89 in 7.3-rc7, frees both sets of options with kfree_rcu(). IPv6 copies the options and is not affected by the first race.

Where each distribution stands

Distribution	Status read on 30 October
Debian 13 trixie	Fixed in linux 6.12.113-1 (DSA-6568-1)
Debian 12 bookworm	Fixed in linux 6.1.190-1 (DLA-4841-1) and linux-6.12 6.12.113-1~deb12u1 (DLA-4850-1)
Debian forky and sid	Fixed in 7.2.12-1 and 7.2.13-1
Ubuntu 26.10, 26.04 LTS, 24.04 LTS, 22.04 LTS	Vulnerable, fix in progress (24.04 in 6.8.0-149.149, 22.04 in 5.15.0-203.213)
Ubuntu 20.04, 18.04, 16.04	Vulnerable, no fix listed
Ubuntu 14.04	Not affected

The Hacker News, which read the other vendors' pages on 29 October, reports Oracle Linux UEK kernels fixed on 16 October, Amazon Linux 2023's kernel6.18 and kernel6.12 packages fixed on 24 and 29 October with its base kernel still pending, SUSE Linux Micro 6.2 and openSUSE Leap 16.0 fixed in kernel-default 6.12.0-160000.40.1, and Red Hat's RHEL fixes "deferred to a future update". Upstream, the stable kernels carrying the fix include 6.6.159, 6.12.113 and 6.18.56.

Why the scores run from 5.9 to 9.8

The kernel team rates the attack complexity low, which gives 9.8. Red Hat, Oracle and SUSE rate it high, because the race is hard to win, and land on 8.1; Red Hat's own CVE page showed Moderate, 5.9, while its machine-readable advisory said Important, 8.1. The researchers who reported it argue that a lost race fails only the one connection attempt and does not crash the machine, so an attacker can keep trying. Their post says their model wrote an exploit giving remote root on servers with a multipath TCP listener, leaking a kernel address in 48 minutes and reaching command execution five minutes later; it gives no code or tested configuration, and the CVE record does not mention multipath TCP. No vendor reports attacks, and the flaw was not in CISA's exploited list on 28 October.

What to do until the package arrives

Debian users should install the kernels above and reboot. On Ubuntu and RHEL there is no package yet; the practical steps are to keep net.ipv4.tcp_migrate_req at its default of 0, to check which services listen with multipath TCP (ss -M lists them) and whether they need to, and to plan a reboot window for when the kernels land. Hosts that run Livepatch or kpatch should watch for a live patch.

We list Canonical and Red Hat.

Sources

• Debian security tracker: CVE-2026-98432 (read 2026-10-30), 30 October 2026
• Ubuntu: CVE-2026-98432 (updated 29 October), 15 October 2026
• Red Hat: CVE-2026-98432 (read 2026-10-30), 30 October 2026
• Linux kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (commit e3f33b0a1d89), 5 October 2026
• The Hacker News: Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions, 29 October 2026