[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

official (Red Hat CVE data and RHSAs Nov 1-3; Ubuntu CVE page updated Nov 3)

Linux TCP RCE CVE-2026-98432: Red Hat now rates it Critical and has shipped RHEL 8, 9 and 10 kernels; Ubuntu also raised it to Critical, but its kernels are still in progress, with an nftables stopgap

  • RHEL: update the kernel and reboot: RHEL 10 RHSA-2026:93413 (6.12.0-211.72.1.el10_2), RHEL 9 RHSA-2026:93412 (5.14.0-687.64.1.el9_8), RHEL 8 RHSA-2026:93414 (4.18.0-553.182.1.el8_10) and kernel-rt RHSA-2026:93415, plus EUS/SAP streams (RHSA-2026:94109, RHSA-2026:94303). Red Hat still lists RHEL 9 kernel-rt and OpenShift CoreOS images as affected.
  • Ubuntu: the linux package is "work in progress" (for example 6.8.0-149.149 on 24.04 and 5.15.0-203.213 on 22.04); 16.04–20.04 GA kernels are still listed as vulnerable. Until kernels reach the regular updates pocket, Ubuntu's mitigation is an nftables input rule at priority -310 that drops ip protocol tcp ip hdrlength > 5, meaning TCP over IPv4 with IP options. It breaks only traffic that relies on IPv4 options, and containers with their own network namespace need the rule applied separately. The exact commands are on Ubuntu's CVE page.
  • Everyone else: Debian, Oracle UEK, SUSE and Amazon Linux fixes were already out (see our Oct 29 item). Upstream fixed versions: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10.

Patch internet-facing hosts first. No vendor reports exploitation in the wild as of this run.

Sources: Red Hat: CVE-2026-98432 (Critical 9.8; RHSA list) · Ubuntu: CVE-2026-98432 (priority Critical; status and nftables mitigation, updated Nov 3) · ctxsec: Oct 29 item on CVE-2026-98432