A use-after-free vulnerability in the Linux kernel’s TCP/IPv4 stack, tracked as CVE-2026-98432, affects every kernel since version 4.4 and forces a review of servers, virtual machines and cloud images. The kernel security team scores it 9.8 out of 10 on CVSS 3.1, but Red Hat puts it at 5.9 and Amazon at 7.0, because exploiting it requires winning a race condition. Fixes are already in the kernel’s stable branches, though several distributions and cloud providers still have them in the pipeline.
CVE-2026-98432 in the cloud in 20 seconds
- It affects the Linux kernel from version 4.4 onward and is fixed in the stable branches 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10.
- Ubuntu, Red Hat and Amazon Linux have patches pending in several versions.
- No active exploitation has been reported, but in the cloud each virtual machine’s kernel is updated by the customer.
The flaw was published on October 15 under the title “ipv4: free inet_opt and ireq_opt after an RCU grace period.” It sits in the function tcp_v4_syn_recv_sock(), which creates a TCP connection’s final socket from the initial request. In doing so, it passes the request’s IP options to the new socket without copying them. If a retransmitted SYN arrives in the meantime while another processor is building the SYN-ACK response, it can read those options after they’ve already been freed. A similar problem shows up when migrating requests between sockets, which only happens if net.ipv4.tcp_migrate_req or an SK_REUSEPORT_SELECT_OR_MIGRATE-type BPF program is enabled. IPv6 is not affected by the main flaw.
Why the score ranges from 5.9 to 9.8
The 9.8 score comes from the Linux kernel team itself, which acts as the CNA (the authority that registers the CVE). It corresponds to the worst-case scenario: network attack, low complexity, no authentication, and high impact on confidentiality, integrity and availability. Ubuntu’s page also lists a CVSS 4.0 score of 8.3, which already factors in attack requirements, and marks the priority as high.
Red Hat is more cautious. It assigns a 5.9, with high attack complexity and impact limited to availability, and explains that a remote, unauthenticated attacker reaching an exposed TCP service could mainly cause a kernel crash, with a theoretical risk of memory corruption. Amazon lands in the middle, at 7.0. None of the sources consulted mentions a public proof of concept or ongoing attacks, and the official CVE record does not include CISA’s exploitation assessment.
What cloud customers need to do
In the public cloud, a virtual machine’s kernel is the customer’s responsibility, not the provider’s. That affects instances on AWS, Azure, Google Cloud and Oracle, as well as base container images and Kubernetes nodes managed by the customer. Ubuntu has the fix in the pipeline for its general kernels and its cloud-specific ones, such as linux-aws, linux-azure, linux-gcp and linux-oracle, across versions 22.04, 24.04, 26.04 and 26.10, but as of October 28 had not published patched packages. Versions 20.04, 18.04 and 16.04 are listed as vulnerable with no fix date.
Debian has already released security updates for trixie (DSA-6568-1, kernel 6.12.113-1) and bookworm (DLA-4841-1, kernel 6.1.190-1). Amazon Linux 2023 has kernel 6.18 fixed (ALAS2023-2026-3251, from October 24), but the Amazon Linux 2 kernels and the main 2023 kernel are still pending. Red Hat has deferred the fix for RHEL 8, 9 and 10, including OpenShift’s RHEL CoreOS nodes, and recommends no mitigation. For anyone who can’t patch yet, the most useful step is to limit the exposure of TCP services over IPv4 to the internet and confirm that net.ipv4.tcp_migrate_req is still disabled, which is its default value. This is the same kind of fast-moving patch race Cloud News has tracked before, from the critical flaw in .NET’s Brotli decoder to the string of critical vulnerabilities disclosed the same week. Step-by-step instructions for checking and updating each distribution are available at administraciondesistemas.com, and the security analysis is at OpenSecurity.
Frequently Asked Questions
What is CVE-2026-98432?
A use-after-free flaw in the Linux kernel’s TCP-over-IPv4 code, present since version 4.4, that can crash the system and, in theory, corrupt memory.
Is it really as severe as its 9.8 score suggests?
It depends on who’s scoring it. The kernel team gives it a 9.8, but Red Hat puts it at 5.9 and Amazon at 7.0, because exploiting it requires winning a race condition. No active exploitation has been reported.
Does my cloud provider patch this for me?
Not on virtual machines: the guest system’s kernel is updated by the customer. On managed services, it depends on each provider.
Sources:
