CVE-2026-98432 is a critical Linux kernel vulnerability in IPv4 TCP, rated CVSS 9.8; a race condition can trigger a use-after-free that may let unauthenticated remote attackers corrupt kernel memory, crash systems or execute code with elevated privileges.

Exploitation depends on specific network and kernel conditions, including crafted IPv4 TCP requests with IP options and race-triggering retransmissions or related socket activity.

Researchers demonstrated a remote code execution scenario involving an MPTCP listener, but MPTCP is not required for the underlying flaw, so disabling it alone does not fully mitigate the risk.

Potentially exposed systems include internet-facing Linux servers and other systems accepting inbound IPv4 TCP connections, such as cloud workloads and container or Kubernetes worker nodes; the article identifies RHEL 8, 9 and 10 and Rocky Linux as potentially affected, with exposure depending on the kernel build and vendor updates.

The article reports no confirmed public attribution to a specific threat actor and cautions against speculation without reliable forensic or threat-intelligence evidence.

Security teams should inventory and prioritize exposed systems, monitor unusual IPv4 options and TCP behavior, instability, unexpected privileged processes and outbound connections, and correlate network and host telemetry; a lack of alerts does not prove a system is unaffected.

For affected Red Hat environments, an interim nftables rule can drop incoming IPv4 TCP packets containing IPv4 header options; administrators should test it, assess service impacts and reapply it after reboot because it is not persistent.

The permanent fix is to install the relevant distribution’s security-patched kernel, reboot if required and verify that the fixed kernel is running; consult vendor advisories rather than relying only on kernel version numbers, and remove temporary rules only after confirming the fix.