Ethical Hacking News
A recent vulnerability discovered in the Linux kernel's IPv4 TCP code has left Red Hat Enterprise Linux and Ubuntu systems vulnerable to a severe remote code execution (RCE) flaw. The CVE-2026-98432 vulnerability, rated as 9.8 out of 10 on the CVSS scale, can be exploited by a remote, unauthenticated attacker, posing a significant threat to the security of Linux systems. This article provides a detailed overview of the vulnerability, its impact, and recommended mitigation measures to protect Linux systems from this critical vulnerability.
Red Hat Enterprise Linux and Ubuntu systems are vulnerable to a severe remote code execution (RCE) flaw due to a recent vulnerability discovered in the Linux kernel's IPv4 TCP code. The CVE-2026-98432 vulnerability, rated 9.8 out of 10 on the CVSS scale, can be exploited by a remote, unauthenticated attacker, posing a significant threat to the security of Linux systems. The flaw arises from passing IP options from incoming requests to new sockets without copying them, allowing an attacker to execute arbitrary code. Red Hat has released patches for its Enterprise Linux 8, 9, and 10, while Ubuntu's fixes remain in its opt-in testing channel with no date for a regular update. Canonical advises that security updates are the only appropriate mitigation for this flaw, and disabling Multipath TCP (MPTCP) is not enough. Amazon Linux, Debian, Oracle Linux, and SUSE have shipped fixes in October, and Linux system administrators are advised to prioritize patching this vulnerability as soon as possible. Interim mitigation measures, such as dropping inbound IPv4 TCP packets carrying IP options, can be used to reduce the attack surface.
A recent vulnerability discovered in the Linux kernel's IPv4 TCP code has left Red Hat Enterprise Linux and Ubuntu systems vulnerable to a severe remote code execution (RCE) flaw. The CVE-2026-98432 vulnerability, rated as 9.8 out of 10 on the CVSS scale, has been present since Linux 4.4 and can be exploited by a remote, unauthenticated attacker, posing a significant threat to the security of Linux systems.
The vulnerability arises when a server accepts an IPv4 TCP connection, passing IP options from the incoming request to the new socket without copying them. If the client retransmits its connection request while another processor still reads those options, the kernel can read memory it has already freed, allowing an attacker to execute arbitrary code. The flaw can be triggered by sending connection requests carrying IPv4 Record Route or Timestamp options to any listening TCP port, and IPv6 is not affected on the main path.
Red Hat has released patches for its Enterprise Linux 8, 9, and 10, shipping RHSA-2026:93414 (RHEL 8), RHSA-2026:93412 (RHEL 9), and RHSA-2026:93413 (RHEL 10) on November 1. A reboot is required after installing the update. The upstream fix for the Linux kernel landed in October, and the CVE team rates the flaw 9.8 out of 10 on the CVSS scale. Red Hat initially rated the flaw Moderate at 5.9 but has since raised its score to 9.8 and now calls it Critical.
In contrast, Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. Canonical has indicated that the fixes for Ubuntu 22.04 LTS, 24.04 LTS, and 26.04 LTS are available in its proposed pocket, an opt-in testing channel. However, the fixes do not install automatically, and administrators who need the fix before it reaches the regular channel can enable the proposed channel and install the kernel update by running specific commands.
Canonical has noted that the Ubuntu Security Team believes that security updates are the only appropriate mitigation for this flaw. Several sources have recommended disabling Multipath TCP (MPTCP) as a workaround, but this alone is not enough, as the flaw is in the IPv4 TCP path, not in MPTCP. The Anthropic team has demonstrated a remote root exploit for the flaw, working against Linux servers with an MPTCP listener, with no credentials and no user interaction.
In addition, Amazon Linux scored the flaw 8.1 and rated it Important, saying the main outcome is a crash with possible memory corruption. Debian, Oracle Linux, and SUSE have shipped fixes in October. As a result, Linux system administrators are advised to prioritize patching this vulnerability as soon as possible to prevent potential attacks.
An interim mitigation published by Red Hat on October 30 involves dropping inbound IPv4 TCP packets carrying IP options using an nftables rule. However, this filter applies only to the host where it is loaded, and traffic between containers on the same host can bypass it. Moreover, the Ubuntu Security Team has cautioned that simply disabling MPTCP is not sufficient, as the flaw is in the IPv4 TCP path, and this advice alone is not enough.
In conclusion, the unpatched TCP flaw leaves Linux systems exposed to a severe remote code execution vulnerability. It is essential for system administrators to prioritize patching this vulnerability as soon as possible and to consider interim mitigation measures to reduce the attack surface. By taking proactive measures, Linux users can prevent potential attacks and protect their systems from this critical vulnerability.
Related Information:
https://www.ethicalhackingnews.com/articles/Unpatched-TCP-Flaw-Leaves-Linux-Systems-Exposed-to-Remote-Code-Execution-A-Critical-Vulnerability-Awaits-ehn.shtml
https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html
https://imtr.net/article/red-hat-patches-98-rated-linux-tcp-rce-flaw-while-ubuntu-releases-fixes-for-9707
Published: Tue Nov 3 08:12:37 2026 by llama3.2 3B Q4_K_M
