[Diary Point = Reporter Choi Seung-jin] A vulnerability has been disclosed in the Linux kernel's IPv4 TCP processing that could allow a remote attacker to crash a system or corrupt memory. Tracked as CVE-2026-98432, the flaw remains unpatched in Ubuntu and Red Hat Enterprise Linux (RHEL) as of October 29.
The bug is a use-after-free issue in which the kernel re-reads a socket option that has already been freed while handling concurrent TCP connection requests. An attacker could repeatedly send specific TCP requests from outside the system to trigger the race condition. The main reported impact is denial of service or kernel crashes, though the possibility of memory corruption has not been ruled out.
Ubuntu and RHEL still awaiting a fix
Ubuntu's security advisory was first registered on October 15 and updated on October 29. Major kernels across the Ubuntu 22.04, 24.04, 26.04, and 26.10 series are listed as either vulnerable or still being patched, and cloud, real-time, and hardware-specific kernel variants may show different statuses.
Red Hat has classified RHEL 8, 9, and 10, as well as the OpenShift 4 series, as affected products, with fixes deferred to a future update. RHEL 7 is not affected because it does not contain the vulnerable code, and Red Hat says there is currently no easy-to-deploy, stable general mitigation available.
Not every Linux device is in the same situation, however. Fixed packages have already been released for Debian Trixie, some Oracle Linux UEK kernels, and some Amazon Linux 2023 kernels. The distribution name alone is not enough to determine your exposure — you need to check both your installed kernel series and the vendor's package status.
Checking your device and kernel with a few commands
Running cat /etc/os-release in a terminal shows your distribution and version, such as Ubuntu, Debian, or RHEL. The kernel currently running can be checked with uname -r. Devices that accept TCP connections from outside networks, such as servers or NAS units, should be checked with higher priority.
On Ubuntu, run sudo apt update && sudo apt full-upgrade, and on RHEL-based systems, run sudo dnf update kernel to check for the latest package from the vendor's repository. Installing a new kernel does not immediately change the kernel currently running, so check your active services and reboot schedule, reboot the system, and then verify again with uname -r.
Users running Ubuntu or RHEL who do not yet have a fixed package should not download kernels from arbitrary internet sources or manually apply only the vulnerability-fixing commits themselves. It's best to periodically check the official repositories and security advisories, and reduce exposure by closing unnecessary internet-facing TCP services or restricting accessible networks — though this is not a vendor-certified fix for the vulnerability.
Ordinary smartphone or router users are not automatically affected simply because their device runs on Linux. Since manufacturers manage their own kernels for these products, users should check the relevant product's security advisories and firmware updates. Personal PC users should only follow the steps above if they have directly installed a Linux distribution such as Ubuntu. As of October 30, no release date has been set for fixed packages in Ubuntu or RHEL.