RED HAT PATCHES 9.8-RATED LINUX TCP RCE FLAW WHILE UBUNTU RELEASES FIXES FOR TESTING

Summary from the TLDR InfoSec newsletter

Red Hat has patched CVE-2026-98432, a 9.8-rated use-after-free in the Linux kernel's IPv4 TCP handling. A remote attacker can send IPv4 Record Route or Timestamp options to a listening TCP port and trigger a race that reads freed memory, potentially allowing code execution. RHEL 8, 9, and 10 fixes require a reboot. No exploitation has been reported. An nftables rule can drop IPv4 TCP packets with IP options, but it does not fully prevent exploitation.