Red Hat patches Linux TCP flaw, Ubuntu tests fixes

Red Hat said it had issued RHSA-2026:93414 for Red Hat Enterprise Linux 8, RHSA-2026:93412 for Red Hat Enterprise Linux 9 and RHSA-2026:93413 for Red Hat Enterprise Linux 10 on 1 November. Canonical said on 2 November that fixes for Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS were in its proposed pocket, and administrators would need to reboot after installing them.

The issue was tracked as CVE-2026-98432 in the Linux kernel's IPv4 TCP code. Red Hat and Canonical said a remote attacker without credentials could use it for code execution, and the bug had existed since Linux 4.4 before the upstream correction landed in October.

The kernel passed IP options from an incoming IPv4 TCP connection into a new socket without copying them first. If a client repeated the connection request while another processor still read those options, the kernel could access memory after freeing it; the trigger involved IPv4 Record Route or Timestamp options on a listening port.

Red Hat published an nftables rule on 30 October that dropped inbound IPv4 TCP packets carrying IP options, but it said the rule could not fully stop exploitation and might break workloads that relied on those options. The CIQ kernel team said the filter only applied on the host where it was loaded, and Canonical said disabling Multipath TCP alone was not enough.

No vendor, CERT or the kernel CVE team had reported attacks, and the issue was not in CISA's exploited-vulnerability catalogue as of 30 October. Anthropic said on 27 October that an internal Claude research model had produced a remote root exploit for Linux servers with an MPTCP listener, while proof-only code on GitHub merely detected the race and did not execute code.