CVE-2026-98432 Score 9.8

Security Advisory – CVE-2026-98432

Severity: Critical – CVSS 3.1: 9.8

CVE-2026-98432 affects the Linux kernel’s IPv4 networking subsystem. The vulnerability is caused by a race condition involving TCP connection requests and socket options, potentially resulting in a use-after-free condition.

The vulnerability may primarily result in a system crash and Denial of Service (DoS). Potential memory corruption is also reported.

The following IT services and products require an impact assessment:

• Linux Server Infrastructure

• Ubuntu Server and Red Hat Enterprise Linux

• Kubernetes and OpenShift platforms

• Linux-based virtualization and cloud infrastructure

• Linux-based network appliances, firewalls and VPN gateways

• Linux-based web, application and database servers

The vulnerability is kernel-related. Applications and services running on an affected Linux kernel may therefore be exposed even if the application itself does not contain the vulnerable code.

The CVE is rated 9.8 Critical by CVE.org. Red Hat currently assigns a preliminary score of 8.1, reflecting a different assessment of attack complexity and impact.

The confirmed primary impact described by Red Hat is Denial of Service, with potential memory corruption. Arbitrary code execution has not been established by the cited vendor descriptions.

Ubuntu currently lists affected kernel packages as vulnerable or work in progress. The availability of vendor patches must be checked against the exact operating system release and kernel variant.

Recommended action: Identify affected Linux systems, assess network exposure and business criticality, monitor vendor security advisories, and implement appropriate mitigations until a validated security update is available.

CVE-2026-98432 – Which IT services and products are affected?

Based on the CVE information published by Ubuntu and Red Hat, I would classify this as a Linux kernel vulnerability with potentially broad infrastructure impact, rather than a vulnerability affecting one specific IT application.

The important distinction is that the vulnerability is in the Linux kernel’s IPv4 networking subsystem. Consequently, the products and services that need to be assessed are primarily those running on affected Linux kernels.

Your observation about the severity increase is also important:

• 15 October 2026: CVE publication.

• 28 October 2026: Ubuntu advisory updated.

• 29 October 2026: The CVE is now rated 9.8 Critical by CVE.org.

• Ubuntu currently shows a CVSS 3 score of 9.8 Critical, while its own priority rating remains High.

• Red Hat reports a preliminary CVSS score of 8.1, with a different assessment of attack complexity.

Sources: Ubuntu CVE-2026-98432 and Red Hat CVE-2026-98432.

Ubuntu+1

1. IT products and services potentially affected

The following is an initial IT service impact assessment. These are potential exposure areas, not a confirmation that every product listed is vulnerable.

Linux Server Infrastructure

High priority for assessment

• Ubuntu Server 20.04, 22.04, 24.04 and 26.04

• Red Hat Enterprise Linux (RHEL)

• Debian Linux

• SUSE Linux Enterprise Server (SLES)

• Oracle Linux

• Amazon Linux

These are relevant wherever the installed kernel contains the vulnerable code.

Container and Kubernetes Platforms

High priority for assessment

• Red Hat OpenShift

• Kubernetes worker nodes

• Kubernetes control-plane nodes

• Docker and containerd hosts

• Rancher-managed Kubernetes

• Managed Kubernetes platforms such as AKS, EKS and GKE

The key concern is the underlying Linux host kernel. Updating a container image alone will generally not resolve a host-kernel vulnerability.

Virtualization and Cloud Infrastructure

• KVM / QEMU

• OpenStack

• Linux-based virtualization hosts

• Cloud Linux instances

• Linux-based private cloud infrastructure

The Linux host or guest kernel must be assessed individually. A Windows guest does not automatically become vulnerable because its hypervisor uses Linux.

Network and Security Appliances

• Linux-based firewalls

• VPN gateways

• Reverse proxies

• Load balancers

• Linux-based routers

• Network monitoring appliances

These products are particularly relevant if they use an affected Linux kernel and process TCP connections through the vulnerable IPv4 code.

What the Internet Was Like in 1995 | Cybercultural

Application and Database Services

• Apache and NGINX web servers

• Linux-based application servers

• PostgreSQL and MySQL database servers

• Linux-based middleware

• API gateways

• File and application servers

The application itself does not need to contain the vulnerability. Its underlying Linux kernel is the relevant component.

The affected component is the Linux kernel, not the application layer.

Ubuntu+1

2. Which IT services should be checked first?

For an IT service provider, I would prioritize the following services:

IT Service

Assessment Priority

Internet-facing Linux servers

High

Linux-based hosting services

High

Kubernetes / OpenShift infrastructure

High

Linux-based VPN and firewall infrastructure

High

Linux-based cloud infrastructure

High

Linux application and database hosting

Medium–High

Internal Linux servers

Medium

Windows Server infrastructure

Not directly affected

Windows desktop clients

Not directly affected

The priority depends on the actual exposure, kernel version, and the role of the system.

For example, a vulnerable Linux server that handles external TCP connections and supports a critical business service deserves more attention than an isolated Linux test system.

3. Important clarification: Is this really only a DoS vulnerability?

This is the most important technical point in your assessment.

The Red Hat advisory describes the vulnerability as follows:

A remote attacker could exploit this vulnerability by sending specially timed network requests, triggering a use-after-free condition.

Red Hat further states that the issue primarily results in a system crash leading to a Denial of Service (DoS) or potential memory corruption.

Red Hat Customer Portal

However, the CVSS 3.1 score published by CVE.org is:

CVE.org CVSS 3.1

9.8 Critical

Critical

CVSS Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Network attack, low complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity and availability.

Red Hat uses a different vector:

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

This results in its preliminary 8.1 score.

Red Hat Customer Portal

assessment

Your argument that the vulnerability’s actual impact is primarily DoS is understandable.

However, I would not formally classify it as “DoS only” based on the available vendor descriptions.

The reason is:

• A use-after-free is a memory-safety vulnerability.

• The reported primary outcome is a system crash.

• Potential memory corruption is explicitly mentioned.

• The CVSS vector assigns High impact to confidentiality and integrity as well as availability.

The available descriptions do not establish that arbitrary code execution is practically achievable. Equally, they do not establish that memory corruption is restricted to a harmless crash.

I would therefore distinguish between the CVSS severity and the confirmed technical impact.

The score is 9.8 Critical, but the practical risk assessment should consider the exploitability, the likelihood of a system crash, and whether the memory corruption can lead to anything beyond DoS.

4. Ubuntu patch status and mitigation

Ubuntu’s advisory currently lists the following status for its main Linux kernel packages:

Ubuntu Release

Kernel Package Status

Ubuntu 26.10

Vulnerable – work in progress

Ubuntu 26.04 LTS

Vulnerable – work in progress

Ubuntu 24.04 LTS

Vulnerable – work in progress

Ubuntu 22.04 LTS

Vulnerable – work in progress

Ubuntu 20.04 LTS

Vulnerable

Ubuntu 18.04 LTS

Vulnerable

The advisory also contains separate statuses for HWE and other kernel variants.

Ubuntu

Your statement that no Ubuntu kernel patch is currently available is consistent with the main kernel packages shown as vulnerable or work in progress in the advisory.

For the IT service assessment, I would recommend:

1. Identify all Linux systems and their kernel versions.

2. Determine which systems are exposed to external TCP connections.

3. Identify whether the systems use affected Ubuntu or Red Hat kernels.

4. Check the vendor advisory for the exact kernel variant and release.

5. Monitor for vendor patches.

6. Document any temporary mitigation and its limitations.

A workaround or custom kernel should be assessed carefully, especially for production infrastructure.

5. Suggested IT service impact statement

If you need to communicate this to your IT service management, security team, or customers, I would use the following wording.

https://ubuntu.com/security/CVE-2026-98432

https://access.redhat.com/security/cve/cve-2026-98432

https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

https://www.anthropic.com/research/discovering-vulnerabilities-with-claude