---
title: Linux TCP RCE CVE-2026-98432: Red Hat now rates it Critical and has shipped RHEL 8, 9 and 10 kernels; Ubuntu also raised it to Critical, but its kernels are still in progress, with an nftables stopgap | ctxsec
url: https://ctxsec.com/items/tip-cve-2026-98432-rhel-fixed-critical-ubuntu-kernels-pending-nft-mitigation
description: "Our Oct 29 item said Red Hat rated CVE-2026-98432 Moderate and had deferred fixes. That has changed: Red Hat now rates it Critical (CVSS 9.8) and released fixed kernels for RHEL 8, 9 and 10 on Nov 1, with more streams on Nov 2-3. Ubuntu raised its priority to Critical on Nov 3 and lists fixed kernels as work in progress for 22.04, 24.04, 26.04 and 26.10. It also published an nftables rule that drops inbound IPv4 TCP packets carrying IP options, which it says reduces but does not remove the risk."
status: "official (Red Hat CVE data and RHSAs Nov 1-3; Ubuntu CVE page updated Nov 3)"
published: 2026-11-03
---

> Our Oct 29 item said Red Hat rated CVE-2026-98432 Moderate and had deferred fixes. That has changed: Red Hat now rates it Critical (CVSS 9.8) and released fixed kernels for RHEL 8, 9 and 10 on Nov 1, with more streams on Nov 2-3. Ubuntu raised its priority to Critical on Nov 3 and lists fixed kernels as work in progress for 22.04, 24.04, 26.04 and 26.10. It also published an nftables rule that drops inbound IPv4 TCP packets carrying IP options, which it says reduces but does not remove the risk.

[← Tips & Guides](/tips) · [markdown](/items/tip-cve-2026-98432-rhel-fixed-critical-ubuntu-kernels-pending-nft-mitigation.md)

official (Red Hat CVE data and RHSAs Nov 1-3; Ubuntu CVE page updated Nov 3)

2026-11-03

### Linux TCP RCE CVE-2026-98432: Red Hat now rates it Critical and has shipped RHEL 8, 9 and 10 kernels; Ubuntu also raised it to Critical, but its kernels are still in progress, with an nftables stopgap

- **RHEL:** update the kernel and reboot: RHEL 10 RHSA-2026:93413 (6.12.0-211.72.1.el10_2), RHEL 9 RHSA-2026:93412 (5.14.0-687.64.1.el9_8), RHEL 8 RHSA-2026:93414 (4.18.0-553.182.1.el8_10) and kernel-rt RHSA-2026:93415, plus EUS/SAP streams (RHSA-2026:94109, RHSA-2026:94303). Red Hat still lists RHEL 9 kernel-rt and OpenShift CoreOS images as affected.
- **Ubuntu:** the `linux` package is "work in progress" (for example 6.8.0-149.149 on 24.04 and 5.15.0-203.213 on 22.04); 16.04–20.04 GA kernels are still listed as vulnerable. Until kernels reach the regular updates pocket, Ubuntu's mitigation is an nftables input rule at priority -310 that drops `ip protocol tcp ip hdrlength > 5`, meaning TCP over IPv4 with IP options. It breaks only traffic that relies on IPv4 options, and containers with their own network namespace need the rule applied separately. The exact commands are on Ubuntu's CVE page.
- **Everyone else:** Debian, Oracle UEK, SUSE and Amazon Linux fixes were already out (see our Oct 29 item). Upstream fixed versions: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10.

Patch internet-facing hosts first. No vendor reports exploitation in the wild as of this run.

Sources: [Red Hat: CVE-2026-98432 (Critical 9.8; RHSA list)](https://access.redhat.com/security/cve/CVE-2026-98432) · [Ubuntu: CVE-2026-98432 (priority Critical; status and nftables mitigation, updated Nov 3)](https://ubuntu.com/security/CVE-2026-98432) · [ctxsec: Oct 29 item on CVE-2026-98432](https://ctxsec.com/items/linux-tcp-ipv4-uaf-cve-2026-98432-ubuntu-rhel-no-fixed-kernel)