Ubuntu lists Linux kernel flaw CVE-2026-98432 at High priority with a 9.8 CVSS score, and as of its October 29 update shows fixes still in progress for four supported releases.
The CVE describes a use-after-free in the kernel’s IPv4 TCP connection setup. Request-socket options are freed with a plain kfree() while another CPU can still be building a SYNACK from them, and the fix switches the free to kfree_rcu(). The record notes that IPv6 is not affected by the first issue, and that a related migration case in the IPv6 destructor “will be addressed in a separate patch.”
Ubuntu published its entry on October 15. For the standard kernel package it marks 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 as vulnerable with work in progress, in kernel builds 5.15.0-203.213, 6.8.0-149.149, 7.0.0-43.43 and 7.3.0-10.10. Releases 20.04, 18.04 and 16.04 are marked vulnerable with no fix listed, and 14.04 is marked not affected. Several hardware-enablement kernels carry the same status.
Debian has shipped fixes. Its security tracker lists bookworm fixed in 6.1.190-1 through DLA-4841-1, and trixie fixed in 6.12.113-1 through DSA-6568-1. The tracker points to the upstream commit that landed in the 7.3-rc7 kernel.
The mismatch between the upstream fix and Ubuntu’s package status is the exposure window for anyone who does not build their own kernel. In our reading, Ubuntu fleets should treat the 9.8 score as a reason to inventory which hosts expose TCP listeners to untrusted networks and to watch the Ubuntu page for the first fixed package, then reboot into it. Our opinion on starting the patch clock on release day makes the same case for upstream fixes, and our brief on a Linux kernel bug that lets VMs read host memory covers an earlier kernel notice.
Source: Ubuntu Security, CVE-2026-98432
