- 6th November 2026
CVE-2026-98432 is a pre-authentication use-after-free in the Linux kernel’s IPv4 TCP handshake, present since kernel 4.4 and shown to reach remote root on MPTCP listeners. In 15 days Red Hat moved its score from 5.9 to 9.8 with no code change. Here is why the scores split and how to patch.
Sarah Mitchell


















