Two October 15 threads belong in one ops pass. CISA added CVE-2026-21589 — Atlassian multiple products, files/directories accessible to external parties — to the KEV catalog on evidence of active exploitation. Separately, CVE-2026-98432 is a Linux TCP inet_opt use-after-free fixed in the October 15 stable kernels (versions called out include 6.12.113 and 6.6.159).
Atlassian first if you expose it
File/directory exposure bugs on collaboration suites are how creds and attachment stores leak without a loud RCE headline. If Jira/Confluence/Bitbucket (or whatever products your advisory maps) face the internet, patch on KEV timing, then check whether the asset was probed before the upgrade. BOD 26-04 thinking applies even outside federal shops.
Kernel UAF is a reboot ticket
The UAF sits in IPv4 TCP option handling around SYN-RECV / SYNACK races — readers already used RCU, but frees did not. Stack.watch reproduces the upstream commit message: use kfree_rcu() in the destruct paths. IPv6 is largely not in the same first failure mode because options are duplicated. Patch the host kernel; do not assume a container reboot fixed the node.
Same week as other networking CVEs — batch the maintenance window, verify uname -r after reboot, and keep Atlassian and Linux tickets from stealing each other’s urgency.
If your Atlassian stack is behind SSO and not internet-exposed, still patch — KEV means someone is already weaponizing the class of bug. For the kernel UAF, prioritize multi-tenant and high-connection hosts first; SYN floods plus option races are where use-after-free bugs enjoy company.
Have a blessed day!