WORLDTECHLinux kernel flaw CVE-2026-98432 can crash Ubuntu systems, GBHackers reports
AI illustrationA critical flaw in the Linux kernel, catalogued as CVE-2026-98432, can crash Ubuntu systems through a memory defect in networking code, according to a report by GBHackers. The vulnerability has been given a CVSS severity score of 9.8.
What the flaw does
The report describes a use-after-free vulnerability in the handling of IPv4 TCP connections. Its origin lies in a function that hands ownership of IP options from a request socket to a newly created child socket without copying the underlying data.
Another processor handling a retransmitted connection-setup packet for the same request can meanwhile build a response that reads those shared options. If the child socket is destroyed before that response is finished, the reader can touch memory that has already been freed.
Timeline and remediation
Canonical, the London-based software company behind Ubuntu, published a security advisory on October 15, 2026, and provided an update on October 29. The report says the problem can cause crashes and service disruptions on affected systems.
The same report notes a related race that affects request socket migration when a specific kernel setting is enabled or a particular BPF program is used.
What is not confirmed
Although the defect can cause a crash, the published description does not present a reliable remote exploit and does not confirm active exploitation. The account rests on a single outlet's reporting of the advisory.
Open questions
- Has the flaw been exploited in practice?
- Which Ubuntu releases are affected in the advisory?