Security researchers have disclosed a critical vulnerability in the Linux kernel's IPv4 TCP stack, tracked as CVE-2026-98432 and rated 9.8 on the CVSS scale. The flaw is a use-after-free condition, meaning the kernel can continue referencing memory after it has been freed, potentially allowing an attacker to corrupt data or execute code. Because TCP is foundational to networked Linux systems, the exposure is extremely broad, spanning servers, cloud infrastructure, and embedded devices.
The bug affects the kernel's handling of certain TCP connection states, according to the technical writeup. An attacker able to send crafted network traffic could trigger the memory error without needing local access, which is why the severity score is so high. Patches have been made available, and administrators are being advised to update affected kernels as soon as possible. Distributions that backport fixes will need to confirm their specific versions are covered.
Use-after-free bugs are especially dangerous in kernel networking code because they can be reached remotely and can undermine the isolation between processes. Even when direct code execution is difficult, a reliable crash can be used for denial of service against critical services. Security teams are also watching for public proof-of-concept exploits, which often appear within days of a high-profile disclosure and can be adapted by less sophisticated attackers.
Organizations should prioritize internet-facing Linux systems, container hosts, and network appliances for patching. Where immediate updates are not possible, network filtering and monitoring for anomalous TCP behavior can reduce risk, though they are not substitutes for the fix. The disclosure is a reminder that core internet protocols remain a high-value target and that kernel-level flaws can affect an enormous share of global infrastructure at once.