October 29, 2026 at 8:55 AM EDT
Linux kernel IPv4 TCP use-after-free (CVE-2026-98432)
criticalpending-analysis
A Linux kernel IPv4 TCP use-after-free carries a 9.8 network score from a secondary scorer while NVD analysis is pending. It is not known to be exploited; patched kernels are available for Amazon Linux 2023 and Debian 12.
Linux kernel: CVE-2026-98432
- What: CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP code. It was published on October 15 but has only recently drawn wider attention.
- Severity: NVD shows a 9.8 network score from a secondary scorer; NVD's own analysis is still in progress.
- Exploited: Not on CISA's Known Exploited Vulnerabilities list, and no confirmed attacks.
- Fixed in:
- Amazon Linux 2023: ALAS2023-2026-3251 and ALAS2023-2026-3335.
- Debian 12: kernel 6.1.190-1.
- Debian 11: The Debian security tracker no longer lists Debian 11 for this CVE, so it is unlikely to receive a fix. Systems still on Debian 11 should plan an OS upgrade.
- What to do: Install the patched kernel and reboot. If you are also applying the Fragnesia (CVE-2026-46300) kernel fix, both can be covered in the same reboot.
General information only. Confirm fixed versions in the linked official advisories before patching.