CONNECT WITH US
Cyber Security

Cyber Security

Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

The Hacker News logo

Published on

Add as a preferred source on Google
Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update.

The flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can lead to remote code execution, Red Hat and Canonical said.

The Linux kernel's own CVE team rates the flaw 9.8 out of 10 on the CVSS scale. Red Hat, which initially rated it Moderate at 5.9, has raised its score to 9.8 and now calls it Critical. The bug has been present since Linux 4.4, and the upstream fix landed in October.

When a server accepts an IPv4 TCP connection, the kernel passes IP options from the incoming request to the new socket without copying them. If the client retransmits its connection request while another processor still reads those options, the kernel can read memory it has already freed.

An attacker triggers the race by sending connection requests that carry IPv4 Record Route or Timestamp options to any listening TCP port. No login is needed. IPv6 is not affected on the main path.

Red Hat shipped RHSA-2026:93414 (RHEL 8), RHSA-2026:93412 (RHEL 9), and RHSA-2026:93413 (RHEL 10) on November 1. A reboot is needed after installing the update.

04 LTS are in its -proposed pocket, an opt-in testing channel. Packages there do not install automatically.



Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.