Red Hat Patches Critical Linux TCP Vulnerability; Ubuntu Fixes Remain in Testing Channel

Red Hat and Ubuntu have addressed a critical vulnerability in the Linux kernel's IPv4 TCP implementation, though their patch deployment timelines differ significantly. The flaw, tracked as CVE-2026-98432, is a use-after-free vulnerability in the IPv4 TCP code. According to reporting, the vulnerability carries a CVSS score of 9.8, classifying it as critical.

Red Hat has released fixed kernels for Red Hat Enterprise Linux 8, 9, and 10. These updates are available for immediate deployment to mitigate the risk of remote code execution.

Ubuntu's approach differs. Fixes for the three newest long-term-support releases are currently available only in the opt-in testing channel, with no set date for a regular update. Users on Ubuntu LTS releases awaiting a stable fix are advised to monitor official Ubuntu security advisories or consider enabling the testing channel if immediate mitigation is required, though this carries its own stability considerations.

The vulnerability can be reached by a remote, unauthenticated attacker sending specially crafted network packets targeting the TCP stack. Successful exploitation could allow an attacker to execute arbitrary code on the affected system. Given the central role of the TCP stack in network communications, systems exposed to network traffic are particularly at risk.

Security researchers and industry analysts recommend that organizations running affected Red Hat Enterprise Linux versions apply the updated kernels immediately. Ubuntu users should check their release status and determine whether to adopt the testing-channel fixes based on their risk tolerance and operational requirements.