Status checked: October 29, 2026.
CVE-2026-98432 is a Linux kernel use-after-free reachable through TCP and IPv4 options. Ubuntu’s entry, last updated on October 28, still marks several kernel packages vulnerable with fixes in progress. The key distinction is between a fix in upstream Linux and a fixed package for your exact Ubuntu release and kernel flavor.
The Linux CNA record was published on October 15. This is a current package-status check, not a claim that the flaw was first disclosed today. Our CVE-2026-98432 vulnerability profile keeps the technical scope and branch fixes together.
Ubuntu’s Package Rows Still Show Work in Progress
The Ubuntu CVE tracker lists the following state for the source package named linux. The version strings are work targets shown beside vulnerable rows. They must not be presented as available security updates or as proof that a host is patched.
The same linux row marks Ubuntu 20.04, 18.04, and 16.04 vulnerable. Other kernel flavors have separate rows, including cloud, hardware enablement, OEM, Raspberry Pi, and real-time packages. A result for the generic source package does not certify those other builds.
Ubuntu’s status definitions make the distinction explicit: work in progress means the team is working on a fix for an affected package. Fixed means a corrected version is available. Read the package and release together. An ignored or absent package row is not interchangeable with a fixed one.
Upstream Fixes Do Not Identify an Ubuntu Package
The Linux CNA record lists branch-specific fixed versions: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. These are upstream version entries, not one universal minimum for every kernel. Distribution backports need their own package evidence.
The Debian security tracker shows why that matters. It lists linux 6.1.190-1 as fixed for bookworm security and 6.12.113-1 for trixie security. Those Debian package results do not establish the status of an Ubuntu kernel with a different package name and revision.
Keep three fields in the patch record: the running kernel, its installed package, and the matching vendor status. A scanner’s upstream version comparison is useful input. It is not enough to close the ticket when the distribution has backported code or still lists the package as vulnerable.
The TCP Race Happens Before Application Login
The CNA’s scoring explanation describes a network peer sending a TCP SYN with IPv4 Record Route or Timestamp options. The kernel stores those options with a connection request. A retransmitted SYN can make one CPU build a SYNACK while another path frees the child socket and its options.
The remaining reader can then use freed memory while building the packet. The CNA describes possible kernel memory disclosure, memory corruption, and crashes. That is a serious remote attack surface. It does not by itself prove that a reliable exploit is being used against deployed systems.
The upstream Linux change replaces immediate freeing in two paths with freeing after an RCU grace period. RCU lets readers finish before the memory is released. A second case involves request-socket migration, including configurations using net.ipv4.tcp_migrate_req=1.
That migration setting is not a requirement for the first TCP/IPv4 path. Turning it off is therefore not a complete fix. The patch also distinguishes IPv6: the first path duplicates options there, while a related CALIPSO migration issue is left to a separate patch. Do not turn that distinction into an all-IPv6 safety claim.
Keep the Two Scores and Exploitation Evidence Separate
Ubuntu displays 9.8 Critical under CVSS 3.1 and 8.3 High under CVSS 4.0. Its own priority is High. The Linux CNA record supplies the 9.8 vector below. These are different scoring systems and a vendor priority, not three competing reports of active attacks.
- Attack Vector
- Network AV:N
- Attack Complexity
- Low AC:L
- Privileges Required
- None PR:N
- User Interaction
- None UI:N
- Scope
- Unchanged S:U
- Confidentiality
- High C:H
- Integrity
- High I:H
- Availability
- High A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H The fetched CISA KEV catalog does not list this CVE. That catalog fact is dated below; absence from KEV is not evidence that exploitation cannot occur. A seven-day stored Venom view also recorded discussion on X. Mention counts measure attention and must not be relabeled as attacks.
- CISA KEVNot seenNot listed in catalog dated October 28, checked October 29.2026-10-29
- X discussionYesStored seven-day Venom view recorded 22 mentions from X; attention is not exploitation evidence.2026-10-29
The public sources used here document the flaw and patch status. They do not establish an in-the-wild exploitation incident for this report. The operational decision should use reachable services, affected packages, and the cost of an outage, rather than treating a score or social post as incident proof.
Build a Host Record Before Closing the Patch Ticket
Start with the host, not the planned version in a web table. On an Ubuntu system, collect its release, running kernel, and installed kernel-image packages. The commands below are inventory steps. They do not test whether the vulnerability can be exploited.
cat /etc/os-release
uname -r
dpkg -l 'linux-image*'- Match the package: identify its kernel flavor and find the exact release row in Ubuntu’s tracker. Keep the status and check time with the host record.
- Review reachability: find the TCP services that need to be reachable. Reduce unnecessary access through your normal network controls while the vendor fix is pending. This is exposure reduction, not a patch.
- Use supported updates: refresh package information and review the available upgrades. Do not treat a successful upgrade command as proof that this specific CVE was fixed.
- Verify the running result: after the approved kernel rollout and any required reboot, record the running kernel again. Check it against a vendor row that actually says fixed.
Ubuntu’s package-management guidance uses the following commands to refresh the package index and upgrade installed packages. Follow your change process. The Ubuntu CVE guidance advises against cherry-picking individual updates.
sudo apt update
sudo apt upgradeFor the wider process, our patch management glossary explains rollout and verification. The Vulnerability Management 101 guide connects those actions to inventory, risk, and closure evidence. Keep this CVE open for any host whose matching package remains vulnerable or whose running result has not been verified.