What vendors say

This is broader than one optional TCP feature

Red Hat describes CVE-2026-98432 as a critical use-after-free in the Linux kernel's IPv4 networking path. A remote, unauthenticated attacker could potentially exploit a timing condition while TCP connections are being established. Red Hat lists RHEL 8, 9 and 10 and OpenShift among affected products. Systems accepting inbound TCP connections deserve the earliest review.

Ubuntu says the vulnerability is present in kernel versions 4.4 and later and rates it critical. A reported, unpublished exploit used Multipath TCP, but both Ubuntu and Red Hat stress that MPTCP is not required for the vulnerability. Disabling MPTCP is therefore not a complete mitigation.

Do not mistake a proposed update for a normal rollout

As of Ubuntu's 2 November post, fixes for Ubuntu 22.04, 24.04 and 26.04 were in the proposed pocket, while older supported releases were pending. Ubuntu 26.10 was listed as fixed. Check the vendor's current status before planning deployment.

Defender workflow

Patch the kernel you actually booted

  1. 1

    Map exposed systems. Identify Linux servers, cluster nodes and appliances that accept inbound IPv4 TCP. Record distribution, release and the running kernel, not just installed packages.

  2. 2

    Track each vendor release. Use the distribution's own advisory for fixed builds and supported backports. Test proposed or interim packages according to your change process.

  3. 3

    Reboot and verify. After a kernel update, restart affected systems and confirm the running kernel version. Record exceptions and compensating network controls until a supported fix is available.

Defender note

Severity is high; exploitation status is a separate fact

The vendor notices describe a serious potential remote-code path, but they do not establish active exploitation in the wild. Red Hat offers an interim packet-filtering idea with explicit caveats; it is not a substitute for a fixed kernel. Treat this as an urgent patch and exposure-management task without inventing an incident.