CVE-2026-98432: which Linux kernels are still vulnerable

CVE-2026-98432 is a use-after-free vulnerability in the Linux kernel's IPv4 TCP handshake affecting versions dating back to Linux 4.4. While upstream fixes and patches for several distributions such as Debian, Amazon Linux, and Oracle have been released, major distributions like Ubuntu and Red Hat have yet to ship final production fixes. The author outlines temporary mitigations, including blocking TCP packets carrying IP options via nftables and disabling MPTCP. Open article →