TCP use-after-free vulnerability CVE-2026-98432 rated 9.8
The gist
A use-after-free in Linux's IPv4 TCP handshake code, present since 4.4, is scored CVSS 9.8 Critical.
Most servers run distribution kernels; Ubuntu and RHEL had no fix by late October.
How it unfolded
- January 2016Linux 4.4 ships with commit 079096f103fa, which introduced the bug.
- Oct 2, 2026The fix is written and committed on October 6.
- Oct 5, 2026Eric Dumazet's two-line fix is applied upstream.