# Linux TCP flaw fixed upstream, not in Ubuntu or RHEL _Atlas says CVE-2026-98432 got a four-line upstream fix Oct 15, but Ubuntu and RHEL kernels remain vulnerable as of Oct 31._ **Published:** 2026-11-01 **Source:** https://www.startuphub.ai/ai-news/artificial-intelligence/2026/linux-tcp-flaw-fixed-upstream-not-in-ubuntu-or-rhel --- [Atlas](https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf) says Linux shipped an upstream fix October 15 for CVE-2026-98432 and Ubuntu and RHEL still have not shipped it as of 5:15 PM CDT October 31. That leaves the most deployed kernels exposed to a remote, unauthenticated use-after-free. The bug sits in the IPv4 TCP handshake before any app sees the connection, per Atlas. A remote peer sends IPv4 options in its SYN, the kernel hands saved option memory from the request socket to the new socket without copying it, then frees it while another CPU can still read it. The kernel CNA scores it CVSS 3.1 9.8, and [Anthropic](/startups/anthropic) researcher Xinyang Ge reported it. Fixed upstream in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3, the commit by Eric Dumazet changes two kfree calls to kfree_rcu, per Atlas. IPv6 is not affected by that code path, and every kernel from 4.4 on without the fix is vulnerable, whether it faces the internet or just hosts containers. [Claude](https://www.startuphub.ai/ai-news/claudes-corner/2026/claudes-corner-crow-yc-w2026) wrote the exploit. [Anthropic](https://www.startuphub.ai/ai-news/artificial-intelligence/2026/ed-zitron-anthropic-and-openai-shouldn-t-ipo) says its model built a working proof-of-concept that gets remote root on Linux servers with a multipath TCP listener, with no credentials. It has not published the exploit. The Go Security Team says that setup is more common than it first looked, because as of Go 1.24 Go programs enable MPTCP by default for listen sockets on Linux where net.mptcp.enabled is 1. The Go team adds the underlying bug is not specific to MPTCP, so systems without a listener may still be vulnerable to similar attacks, per Atlas. The distribution split is stark in practice. Atlas checked trackers October 31 and found Debian 12 and 13, SUSE Linux Enterprise Server 16.0 and the 15 SP4 through SP6 LTSS kernels, Oracle UEK on Oracle Linux 7 through 10, and every Amazon Linux 2 and 2023 kernel as fixed. AlmaLinux has fixed kernels in its testing repository since October 30 for AlmaLinux 8, 9 and 10, ahead of RHEL, but has not promoted them to production, per Atlas. Red Hat lists RHEL 8, 9 and 10 and OpenShift Container Platform 4 and 5 as affected with no fix, and raised its rating from Important 8.1 to Critical 9.8 on October 30. Ubuntu lists its linux package as Vulnerable on every release, with work in progress version strings on 22.04 through 26.10 and no Ubuntu Security Notice yet. That context matters because enterprise patch flows diverge even on the same upstream patch. AlmaLinux confirms the flaw is a use-after-free in incoming IPv4 TCP setup with a network vector and no privileges or user interaction, and says patched kernels are available in testing, per its Oct 30 advisory. Amazon Linux moved faster and published fixed kernels for its default, 6.12 and 6.18 lines between October 24 and October 30, covering all its variants, per Atlas. Debian, SUSE and Oracle also shipped within days. If you run Ubuntu or RHEL you are still waiting on the vendor kernel, and uname -r alone will not tell you if you are safe. Check the distribution tracker version, not the upstream number, and reboot. Containers report the host kernel, so you must patch the host and the node, not just rebuild images. If you cannot patch yet, the interim block is noisy but narrow. Atlas and Red Hat publish the same nftables rule to drop inbound IPv4 TCP with hdr length greater than 5, which matches any packet carrying IPv4 options, and an equivalent iptables raw rule. Atlas tested the nftables rule in a Debian 12 container and says it dropped a SYN with Record Route and left normal TCP working. Red Hat says its rule reduces exposure but cannot fully prevent exploitation. You should also turn off MPTCP if you do not use it and patch any host that shows an MPTCP listener with ss -Mlnp first. Those listeners are the path [Anthropic](https://www.startuphub.ai/ai-news/artificial-intelligence/2026/ed-zitron-anthropic-and-openai-shouldn-t-ipo) weaponized, and with Go 1.24 they appear without explicit config. The uncomfortable fact for operators is that retry is cheap. Anthropic notes a lost race only fails the handshake without crashing the system, so an attacker can retry indefinitely until it hits, per Atlas. Until Ubuntu and RHEL ship, the only reliable fix is a distribution kernel update and a reboot. --- Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory. © StartupHub.ai. All rights reserved. You may not republish this article in full without a license. Search engines and AI research tools may crawl and summarize for reference. Bulk reproduction or model training on this content requires a license. See https://www.startuphub.ai/terms.