Red Hat and Ubuntu have issued critical updates to address a severe vulnerability in the Linux kernel’s IPv4 TCP implementation. This flaw, identified as CVE-2026-98432, poses significant security risks, enabling potential remote code execution by unauthenticated attackers. The vulnerability, which has been present since Linux version 4.4, has been rated 9.8 out of 10 on the CVSS scale, highlighting its critical nature.
Details of the Vulnerability
The issue arises when a server handles an IPv4 TCP connection. During this process, IP options from incoming requests are passed to new sockets without proper copying. If a client resends its connection request while another processor is reading these options, it may cause the kernel to access already freed memory. This race condition can be exploited by attackers sending requests with specific IPv4 options to any active TCP port, without needing login credentials. Notably, IPv6 remains unaffected by this flaw.
Red Hat and Canonical’s Response
On November 1, Red Hat released patches RHSA-2026:93414, RHSA-2026:93412, and RHSA-2026:93413 for Red Hat Enterprise Linux versions 8, 9, and 10, respectively. These patches require a system reboot post-installation. Meanwhile, Canonical has placed its kernel updates for Ubuntu’s latest long-term-support releases in an opt-in testing channel, with no scheduled date for general availability. These updates undergo extensive testing across over 2,000 certified servers and devices.
Mitigation and Future Outlook
As an interim measure, Red Hat proposed an nftables rule to block IPv4 TCP packets with IP options, though it may disrupt certain workloads dependent on IPv4 options. Additionally, disabling Multipath TCP (MPTCP) was suggested, despite the flaw residing in the IPv4 TCP path. Canonical emphasizes that comprehensive security updates are the most effective mitigation strategy.
Currently, there are no reported incidents of this vulnerability being exploited in the wild. However, a proof-of-concept has surfaced, demonstrating the flaw’s potential to leak kernel addresses and escalate privileges. Organizations using affected systems are urged to apply the necessary patches promptly to safeguard their infrastructure.
As the situation develops, administrators should remain vigilant, keeping abreast of updates from their respective Linux distributions to ensure continued protection against potential exploits.
