The Linux TCP fix is landing. Here’s how to get ready.

A serious Linux networking bug has an encouraging update: patches are already available for Red Hat Enterprise Linux, and Ubuntu has put its first fixes into testing. If you run a Linux server, this is a good moment to check your kernel and plan a reboot—not a reason to panic.

What happened?

CVE-2026-98432 is a use-after-free bug in the kernel code that handles IPv4 TCP connections. An attacker can send specially timed connection requests with IPv4 options to a listening service without logging in. The result could be a crash or memory corruption; researchers have also demonstrated remote code execution under specific conditions. Red Hat rates the issue Critical at 9.8 out of 10.

That sounds grim, but the response is moving. The upstream kernel fix has been made, vendors are shipping their own backports, and administrators have concrete places to check for updates. The important distinction is between a fix that exists somewhere and a fixed kernel that is actually installed and running on your machine.

Where the fixes stand

Red Hat released kernel advisories for RHEL 8, 9 and 10 on 1 November. If you manage one of those systems, use the update provided for your exact release, then reboot. The Red Hat bulletin also flags OpenShift and other products that use the RHEL kernel; updating an application container alone will not replace the host kernel.

For Ubuntu, Canonical says fixes for the generic kernels in 22.04, 24.04 and 26.04 LTS are available in its opt-in -proposed pocket while qualification testing continues. These are early packages for people who can run their own acceptance tests; they are not ordinary updates that will install automatically. Canonical says the regular updates will follow once testing is complete. Ubuntu 20.04 and older supported releases are still awaiting their respective fixes. Kernel flavours such as HWE, cloud, FIPS and real-time have separate status, so check your actual package rather than assuming the generic-kernel timetable applies.

Canonical’s blog says Ubuntu 26.10 is fixed, but its CVE package tracker still shows work in progress for the generic linux package. Until those records agree, check the repository package and the live tracker before calling that release covered.

A useful check you can do today

On a Linux machine you manage, run uname -r to see the kernel you are running, and note the distribution release and kernel package or flavour. Compare those details with your vendor’s advisory linked below. A version number by itself is not universal proof: distributions backport fixes, and a newly installed kernel does not take effect until you reboot into it.

On RHEL, use the normal vendor-supported kernel update path and schedule that reboot. On Ubuntu 22.04 or newer, if you want to evaluate the early fix, do it first on a non-production machine that resembles your workload. Canonical provides the -proposed setup and installation steps in its own guide. Test your applications and connectivity, then verify the running kernel after reboot. If you cannot accept a testing-channel kernel, follow Canonical’s CVE tracker for the regular update instead.

Keep the risk in perspective

Anthropic demonstrated a research exploit against a host with a Multipath TCP listener. That is evidence the bug can be serious, not evidence that every exposed server has been compromised. AWS said on 2 November that it had no evidence of exploitation in the wild. Equally, disabling Multipath TCP is not a solution: Red Hat and Canonical both say the underlying flaw is in the ordinary IPv4 TCP path.

Red Hat has published an IPv4-options filtering rule that can reduce exposure while you arrange an update, but it is incomplete and can miss traffic inside container networks. The real finish line is a vendor-patched kernel, rebooted and verified. The good news is that for many systems, that path is already open—and for the others, the first testable packages and public status pages make it easier to prepare now.