> ## Content Index
> Fetch the complete content index at: https://stackurity.ai/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# Linux kernel TCP flaw CVE-2026-98432 scores 9.8
- URL: https://stackurity.ai/blog/linux-kernel-tcp-cve-2026-98432-use-after-free/
- Published: 2026-10-30T03:35:03.000Z
- Updated: 2026-10-30T12:23:00.000Z
- Description: CVE-2026-98432 is a critical Linux kernel TCP use after free affecting Ubuntu and Red Hat. See how to check your servers and what to watch for in updates.
- Author: Stackurity Research Team
- Tags: Linux Servers, News

**TL;DR:** A Linux kernel TCP flaw, CVE-2026-98432, carries a critical score and affects Ubuntu, Red Hat Enterprise Linux and other distributions. Watch for your distribution's kernel update and plan the reboot.

## What happened

The Hacker News [reported](https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html) a bug in the network stack of the Linux kernel, identified as CVE-2026-98432, that affects Ubuntu, Red Hat Enterprise Linux and other distributions. The [National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-98432) shows a CVSS v3.1 score of 9.8, and the kernel project's own record was published on October 15, 2026.

The problem is a use after free in how IPv4 connection options are released. A connection can be freed while a reply to a connection request is still being built from its data on another processor. The fix delays freeing that memory until it is safe. The record says IPv6 is not hit by the first part of the problem.

The NVD entry is not yet analysed and lists no affected version range, so the fixed kernel versions are not in the data we hold. Take them from your distribution's kernel advisory.

## Am I affected?

Assume every Linux server running a kernel from your distribution is a candidate until its vendor says otherwise. Check what a machine runs with:

```
uname -r
```

Distributions backport fixes and keep the kernel version number, so compare the package changelog or the vendor notice, not the number alone. A new kernel only protects you once the machine boots into it.

## How to check with Stackurity

Stackurity assesses installed packages on Debian, Ubuntu, Rocky Linux, AlmaLinux, Red Hat Enterprise Linux, SUSE Linux Enterprise and other major distributions, using each distribution's own version rules so that backports are not reported as false alarms. Matching runs every hour, and after the update a check again records whether the finding is gone. It does not assess CentOS, Oracle Linux or Fedora packages, which show up as gaps. [Start a free trial](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=linux-servers&utm%5Fcontent=linux-kernel-tcp-cve-2026-98432-use-after-free), and see [how verification works](https://stackurity.ai/docs/verification). Our post on [another exploited kernel flaw](https://stackurity.ai/blog/linux-kernel-cve-2026-46300-added-to-cisa-kev/) covers the same workflow.