Red Hat patches critical Linux TCP flaw; Ubuntu fixes remain in testing

Red Hat releases kernel fixes

Red Hat released fixed kernels for CVE-2026-98432, a use-after-free vulnerability in the Linux kernel’s IPv4 TCP code. The flaw, rated 9.8, can be reached by a remote, unauthenticated attacker and permits remote code execution, according to the security report.

The fixes are available for Red Hat Enterprise Linux 8, 9 and 10. That represents a completed patch release for the named enterprise Linux versions, rather than a broader claim that every Linux distribution has addressed the vulnerability.

Ubuntu patches remain in testing

Ubuntu has released fixes for CVE-2026-98432 for its three newest long-term-support releases, but the patches remain in the opt-in testing channel. As of the report’s November 3 publication, no date had been set for a regular Ubuntu update.

The difference between the two distributions’ stages is important: Red Hat’s fixes were available in fixed kernels, while Ubuntu’s fixes had not yet reached the regular update channel. The reviewed reporting did not establish broader adoption, exploitation or customer deployment.

Separate Linux releases reported

Elsewhere, the openSUSE Project announced openSUSE Leap 16.1, describing it as a release that combines traditional and immutable Linux approaches. The available report excerpt did not provide enough detail to expand on individual features, rollout stages or broader adoption.

Linus Torvalds also released Linux 7.4-rc1, which the report said contained nearly 20,000 commits and fixes found with the help of AI. Linux 7.2.15 was identified as the final 7.2.y update, directing users to move to the 7.3.y branch or an LTS kernel. These developments were separate from the CVE-2026-98432 patching status.