Red Hat Called This Bug a 5.9. Two Weeks Later It Was a 9.8.
- Created
- 9 Nov 2026
- Last reply
- 6 minutes ago
- Replies
- 0
- Views
- 0
- Reactions
- 0
Discussion of the blog article Red Hat Called This Bug a 5.9. Two Weeks Later It Was a 9.8..
CVE-2026-98432 is a use-after-free in the IPv4 TCP handshake, reachable by anybody who can reach a listening port, sitting in the kernel since 4.4. Red Hat scored it 5.9 moderate and deferred the fix. Then 8.1. Then 9.8.
Discussion thread — share findings, corrections and follow-ups below.