Red Hat issued a fix for CVE-2026-98432 in standard RHEL 8 kernel packages on November 1, 2026. Advisory RHSA-2026:93414 lists kernel version 4.18.0-553.182.1.el8_10; Red Hat says a reboot is required for the update to take effect (Red Hat’s erratum).
What the RHEL 8 erratum fixes
The erratum covers standard RHEL 8 kernel packages. It names 4.18.0-553.182.1.el8_10 as the fixed package, and the kernel change takes effect after a reboot.
How the kernel race works
CVE-2026-98432 is a use-after-free in Linux’s IPv4 TCP handling. During connection processing, one path can free socket-option memory while another is still reading it. The upstream fix replaces immediate kfree() calls with kfree_rcu(), which defers freeing until readers have finished. It also addresses a related request-socket migration path (upstream Linux commit).
The upstream commit says the first race does not affect IPv6 because its TCP path duplicates the options; a related IPv6 migration issue was to be handled separately. Anthropic’s October 27 account described a laboratory exploit on a Linux server with an MPTCP listener. The company reported that Claude’s proof of concept took 48 minutes to leak a kernel pointer and five additional minutes to reach command execution (Anthropic’s account). The demonstrated setup used MPTCP, but the Go Security Team says the underlying kernel bug is not specific to MPTCP (Go Security Team notice).
What myNode says v0.3.52 includes
myNode says version v0.3.52 includes kernel updates where available, mitigations for other platforms, and LND v0.21.6 with an additional fix. The release therefore includes more than kernel updates (myNode’s announcement).
Sophos says Sophos Firewall is affected
Sophos support said its engineering team confirmed Sophos Firewall is affected. Support also said MPTCP is not enabled and may reduce risk, while engineers were evaluating upstream patches for a future SFOS release (Sophos support response).
