A critical, unauthenticated Linux kernel bug still has no RHEL fix

CVE-2026-98432 is a use-after-free race in the Linux kernel’s IPv4 TCP connection handling, present in every kernel since 4.4 from January 2016. Red Hat rates it 9.8, critical, and says a remote attacker needs no authentication and no user interaction, just correctly timed TCP connection requests, to trigger it.

The upstream fix landed in stable kernels in mid-October: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and later. Red Hat raised its own severity rating to critical on 30 October. Its bulletin, RHSB-2026-016, still reads “Red Hat is expediting the release of fixes”, with no fixed package version for RHEL 8, 9 or 10 yet. In the meantime it publishes an nftables rule that drops incoming IPv4 TCP packets carrying IP options, which it describes as reducing exposure, not preventing the bug, and warns it “may disrupt necessary workloads”.

Why it matters: if you run RHEL, CentOS Stream, or anything built on their kernel packages, including OpenShift and OpenStack, you are exposed to an unauthenticated remote root-level bug with no official patch yet. Check whether your distribution has shipped a fixed kernel before assuming you’re covered, and consider the nftables mitigation as a stopgap only.

table inet cve_2026_98432 {
    chain input {
        type filter hook input priority -310; policy accept;
        ip protocol tcp ip hdrlength > 5 counter drop
    }
}

The caveat: Red Hat’s bulletin does not report exploitation in the wild, and exploitation requires precise network timing. This is a severe, unpatched bug in widely deployed infrastructure, not a confirmed active attack.