CVE-2026-98432 is a critical vulnerability in the Linux kernel, with a CVSS score of 9.8. The flaw is a use-after-free bug located in the IPv4 TCP code, which allows remote, unauthenticated attackers to execute arbitrary code on affected servers.
Red Hat has released patches for Red Hat Enterprise Linux (RHEL) versions 8, 9, and 10 as of November 1, 2026. Amazon Linux has also issued fixes for its affected kernels between October 24 and 30, 2026. As of November 2, 2026, Ubuntu's security tracker lists versions 22.04, 24.04, 26.04, and 26.10 as vulnerable.
The vulnerability has existed since Linux kernel version 4.4 and can be exploited by sending specially crafted TCP packets with IPv4 options. Red Hat advises that filtering incoming TCP packets with IPv4 options can reduce exposure, though it does not fully prevent exploitation. Disabling Multipath TCP (MPTCP) is recommended as a temporary mitigation measure.
Anthropic reported that its internal research model developed a proof-of-concept exploit for the vulnerability. Despite this, no evidence has been reported of real-world exploitation of CVE-2026-98432. Red Hat's initial rating of the vulnerability was Moderate at 5.9 before being raised to Critical at 9.8.