Critical Linux TCP flaw allows remote code execution without authentication

Red Hat has released critical patches for a severe remote code execution vulnerability in the Linux kernel, while Ubuntu places its fixes in an opt-in testing channel. The flaw, identified as CVE-2026-98432, affects the IPv4 TCP implementation and carries a CVSS score of 9.8 out of 10. This development marks a significant security event for infrastructure teams managing Linux servers across major distributions.

What happened

The vulnerability stems from a use-after-free error in how the Linux kernel handles IPv4 TCP connections. When a server accepts a connection, it passes IP options from the incoming request to the new socket without creating a copy. If a client retransmits the connection request while another processor is still reading those options, the kernel may access memory that has already been freed. An attacker can trigger this race condition by sending connection requests with specific IPv4 Record Route or Timestamp options to any listening TCP port. No authentication is required, and the attack vector is entirely remote.

Red Hat initially rated the issue as Moderate with a score of 5.9 but later raised it to Critical at 9.8 after further analysis. The bug has existed in the kernel since version 4.4, though the upstream fix was only merged in October. Red Hat shipped updates for RHEL 8, 9, and 10 on November 1, requiring a reboot to take effect. Ubuntu announced on November 2 that fixes for its 22.04, 24.04, and 26.04 LTS releases are available in the -proposed pocket, an opt-in testing channel. Canonical stated that no release date for the regular update channel has been set, as they continue testing across more than 2,000 certified devices.

How it works

The core mechanism involves a race condition during the TCP handshake. Normally, when a TCP packet arrives, the kernel processes its headers and options. In this flawed implementation, the kernel references the IP options directly from the original packet buffer rather than copying them to a safe, persistent location. If the network stack processes a retransmission of the same packet concurrently on a different CPU core, the original buffer might be freed or reused before the second read completes. This allows an attacker to manipulate the memory content being read, potentially leading to arbitrary code execution with root privileges.

IPv6 is not affected on the main path, limiting the scope to IPv4 traffic. While some advisors suggested disabling Multipath TCP (MPTCP) as a workaround, Canonical clarified that the flaw resides in the standard IPv4 TCP path, making MPTCP settings irrelevant to the primary exploit vector. The only reliable mitigation remains applying the kernel patch. Red Hat provided an interim nftables rule to drop inbound IPv4 TCP packets with IP options, but this may break legitimate workloads and does not fully prevent exploitation, particularly for container traffic on the same host.

Key details

• Vulnerability ID: CVE-2026-98432, rated 9.8/10 by the Linux kernel CVE team.
• Affected Systems: Linux kernels since version 4.4; specifically impacts RHEL 8, 9, 10 and Ubuntu 22.04, 24.04, 26.04 LTS.
• Attack Vector: Remote, unauthenticated attacker sending IPv4 TCP packets with Record Route or Timestamp options.
• Red Hat Fix: Available via RHSA-2026:93414, RHSA-2026:93412, and RHSA-2026:93413; requires reboot.
• Ubuntu Status: Fixes in -proposed channel; older LTS versions (20.04, 18.04, 16.04) have no fix yet without Ubuntu Pro.
• Exploit Status: No wild exploits reported, but Anthropic’s internal AI model generated a working root exploit in proof-of-concept tests.

Why it matters

For software engineers and IT leads, this vulnerability represents a high-severity risk because it requires no user interaction or credentials. Any publicly facing Linux server running an unpatched kernel is potentially vulnerable to full system compromise. The fact that an AI model was able to generate a working exploit highlights the accelerating speed at which theoretical vulnerabilities can become practical threats. Although Anthropic did not publish the code, the existence of such a tool suggests that motivated attackers may develop similar capabilities quickly.

The disparity in patch availability between Red Hat and Ubuntu also creates operational challenges. Red Hat users can apply fixes immediately, while Ubuntu users must decide whether to enable the -proposed channel, which carries a higher risk of instability due to less extensive testing. Teams managing mixed environments must coordinate reboots and verify kernel versions carefully. The interim mitigation using nftables is imperfect and may disrupt network diagnostics or specific application behaviors that rely on IP options, forcing a trade-off between security and functionality until official patches are widely deployed.

What you can do

• Check your current kernel version using uname -r and compare it against the fixed versions listed in vendor advisories.
• For RHEL systems, apply the latest errata (RHSA-2026:93414, 93412, or 93413) and schedule a reboot.
• For Ubuntu LTS systems, consider enabling the -proposed pocket if immediate protection is required, following Canonical’s specific commands.
• Implement the Red Hat nftables rule as a temporary measure if you cannot patch immediately, but monitor for broken connectivity.
• Verify that your firewall rules do not inadvertently allow IPv4 TCP packets with unusual IP options from untrusted sources.
• Plan for mandatory reboots across your infrastructure, as kernel updates for this flaw cannot be applied live without a restart.