Linux's October 2026 TCP Use-After-Free: CVE-2026-98432
Summary
An Atlas Security advisory analyzes CVE-2026-98432, a critical remote use-after-free in Linux kernel IPv4 TCP handshake (CVSS 9.8). It details affected kernel versions, upstream fixes published in October 2026, and patch status across major distributions (Ubuntu, Red Hat, Debian, SUSE, Amazon Linux). The piece explains how to check your running kernel and whether you have a multipath TCP listener, outlines remediation steps (install fixed kernels and reboot), and provides interim mitigations for systems that cannot patch immediately. It also tracks exploitation status, timelines, and references to primary sources for further reading.