Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing
Red Hat fixes Linux TCP RCE flaw; Ubuntu fixes remain in testing.
Red Hat has released patched kernels for a critical use-after-free vulnerability in the Linux kernel's IPv4 TCP code, affecting RHEL 8, 9, and 10. The flaw, CVE-2026-98432, is rated 9.8 and allows remote, unauthenticated attackers to exploit it. Ubuntu has also developed fixes for its LTS releases, but they are currently only available in the opt-in testing channel.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Red Hat?
Get an email when a new story names Red Hat, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical use-after-free vulnerability (CVE-2026-98432) in the Linux kernel's IPv4 TCP stack has been rated 9.8/10, allowing remote, unauthenticated attackers to potentially execute arbitrary code on affected systems. Red Hat has released patched kernels for RHEL 8, 9, and 10, while Ubuntu's fixes remain in an opt-in testing channel rather than being pushed to stable releases immediately. This gap between patch availability and deployment represents a dangerous window of exposure, especially for internet-facing Linux servers. The severity of an unauthenticated RCE at the kernel level means that any delay in patching could result in full system compromise with no user interaction required.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-98432