Linux kernel CVE-2026-98432 (IPv4 TCP use-after-free in ip_options_build, scored 9.8 by the kernel CVE team): which kernels are fixed, which distros have patches, and what can I do while RHEL/Ubuntu fixes are pending?

What it is: CVE-2026-98432 is a race in the Linux kernel's IPv4 TCP handshake code. When a connection is accepted, tcp_v4_syn_recv_sock() hands the request's IP options to the new socket without copying them; if another CPU is sending a SYNACK for the same request at that moment, it can read options that were already freed, a use-after-free in ip_options_build(). A related path exists when request-socket migration is enabled (net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). The bug dates back to Linux 4.4. The kernel CVE team scores it CVSS 9.8 (network, no authentication); distributions score it lower (Red Hat, SUSE and Oracle 8.1, Amazon 7.0). As of October 29, 2026 it was not in CISA KEV and no vendor reported exploitation, though a root exploit has been claimed publicly without being published. IPv6 isn't affected by the main race. Am I affected: - Kernels from 4.4 up to the fixed stable releases: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. Check with uname -r, but for distribution kernels go by the vendor's tracker, since fixes are backported under different version numbers. - Distribution status (as of Oct 29): Debian 12 and 13, Oracle Linux UEK, Amazon Linux 2023 kernel6.12/6.18 and several SUSE releases have fixes; RHEL 8/9/10 lists the fix as deferred; Ubuntu 22.04 and later are in progress. Check your vendor's CVE page for the current state. Fix: 1. Where a fixed kernel exists, install it and reboot (or apply your vendor's livepatch if it covers this CVE). Debian: apt update && apt full-upgrade; Oracle/Amazon/SUSE: their kernel errata. 2. On RHEL and Ubuntu, subscribe to the vendor CVE page and be ready to patch and reboot quickly when the update ships. 3. Meanwhile, reduce exposure: make sure net.ipv4.tcp_migrate_req is 0 (the default; sysctl net.ipv4.tcp_migrate_req) and review any eBPF reuseport migration programs; keep internet-facing TCP services to what's needed. No vendor has published an official workaround, so treat other network-level ideas as unverified. 4. Watch kernel logs for oopses mentioning ip_options_build or ip_build_and_send_pkt, and investigate any unexplained crashes on exposed hosts. Verify: uname -r shows the patched kernel after reboot, and your distribution's CVE tracker lists your kernel package version as fixed. Sources: https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox https://security-tracker.debian.org/tracker/CVE-2026-98432 https://access.redhat.com/security/cve/CVE-2026-98432 https://ubuntu.com/security/CVE-2026-98432