Linux IPv4 TCP handshake use-after-free bug rated 9.8; Ubuntu and RHEL 8–10 still unpatched
What happened
A November 1, 2026 report disclosed a use-after-free flaw in the Linux IPv4 TCP handshake, CVE-2026-98432, rated CVSS 3.1 9.8 by the kernel CNA. Unpatched Linux 4.4 and later kernels are affected, and several stable branches have shipped fixes. As of 8pm CDT on October 29, Ubuntu releases and RHEL 8, 9 and 10 still had no fix. The report also notes hosts must be rebooted after the kernel update for the fix to take effect.
Written by AI from the coverage · updated 2 hours ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pagePickLinux TCP use-after-free CVE-2026-98432 explained, CVSS 9.8
A use-after-free flaw in the Linux IPv4 TCP handshake, CVE-2026-98432, carries a CVSS 3.1 score of 9.8 from the kernel CNA, and fixes have landed on several stable branches. Unpatched Linux 4.4 and later kernels are affected. As of 8:00 PM CDT on October 29, Ubuntu releases and RHEL 8, 9 and 10 had no fix, and a kernel update needs a host reboot to take effect.
Heat over time
Not enough continuous observations to draw a trend yet.