Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

Red Hat has shipped fixed kernels for RHEL 8, 9, and 10 to close a use-after-free bug in the Linux kernel's IPv4 TCP stack, tracked as CVE-2026-98432, while Canonical's equivalent fixes for Ubuntu 22.04, 24.04, and 26.04 LTS are still sitting in the opt-in -proposed testing pocket with no set release date. The bug, present since Linux 4.4, lets a remote attacker with no credentials trigger a race condition by resending TCP connection requests carrying IPv4 Record Route or Timestamp options, causing the kernel to access already-freed memory and potentially execute code; the Linux kernel CVE team and Red Hat both now rate it 9.8/Critical. Red Hat's updates (RHSA-2026:93414, 93412, 93413) require a reboot, and it also published an nftables rule to drop IPv4 packets with IP options as a partial stopgap, while Canonical says only full kernel updates, not disabling MPTCP, properly mitigate the issue. No in-the-wild exploitation has been confirmed, though Anthropic disclosed that an internal Claude model independently produced a working root exploit against MPTCP listeners, and partial proof-of-concept code has since surfaced publicly.