Update: This follows my post on CVE-2026-98432, the Linux TCP bug Anthropic’s model exploited. When I wrote that one, neither RHEL nor Ubuntu had fixed kernels.
What’s new
- Red Hat shipped fixed kernels for RHEL 8, 9 and 10 on November 1 and raised its score from 5.9 (Moderate) to 9.8 (Critical). You need a reboot after the update.
- Canonical’s fixes for Ubuntu 22.04, 24.04 and 26.04 LTS are only in the opt-in
-proposedpocket, with no date for the regular channel. 20.04 and older have no fix yet. - The bug has been there since Linux 4.4. Any listening IPv4 TCP port can be hit with connection requests carrying Record Route or Timestamp options. No login needed. IPv6 isn’t affected on the main path.
- Red Hat also published an nftables rule that drops inbound IPv4 TCP packets with those options as a stopgap.
What I’d do
Patch and reboot the RHEL-family boxes now. On Ubuntu, either pull the kernel from -proposed on the exposed servers or use the drop rule until the real update lands. Then check uname -r to make sure you’re actually running the fixed kernel.
God Bless, and Needs Garlic!
