Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

A critical use-after-free vulnerability in the Linux kernel's IPv4 TCP code, tracked as CVE-2026-98432, has been patched by Red Hat and is under testing by Ubuntu. The flaw, rated 9.8 on the CVSS scale, allows remote, unauthenticated attackers to achieve remote code execution by exploiting a race condition when handling TCP connection requests with IPv4 options such as Record Route or Timestamp. The vulnerability has existed since Linux 4.4 and affects multiple distributions, including Red Hat Enterprise Linux 8, 9, and 10, as well as Ubuntu's newer LTS releases. While no active exploitation in the wild has been reported, Anthropic disclosed that an internal AI model successfully generated a working exploit proof-of-concept, achieving root access within minutes on vulnerable systems.

AI-extracted · verify before operational use