TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8

A critical use-after-free vulnerability (CVE-2026-98432) in Linux's IPv4 TCP handshake was patched in October 2026, with a CVSS score of 9.8, allowing remote unauthenticated attackers to potentially execute commands as root on affected servers. The bug affects Linux kernels from version 4.4 onward and sits in code that processes every incoming TCP connection before application-level handling, making it extremely urgent. Major distributions including Ubuntu, Red Hat Enterprise Linux 8/9/10, and Amazon Linux 2/2023 still lack the fix as of late October 2026, leaving millions of servers vulnerable.