CVE-2026-98432

We are aware of the Linux TCP flaw which impacts the Red Hat Operating System

This impacts all 4.x customers.

It is important to note that while this vulnerability is reported as a critical Remote Code Execution (RCE) issue, this designation was originally disputed by Red Hat who had the CVE down as Moderate / Important and a Denial of Service (DoS) issue. The original payload and exploit required a Multipath Path TCP (MPTCP) listener to successfully exploit RCE, which is off by default in the VQCM. 

The 4.10 VQCM release will contain the fixed kernel version and we encourage all customers to upgrade to 4.10 to ensure they are up to date with the latest security fixes

There is no known workaround or mitigation for this vulnerability – Some filtering rules have been suggested by Red Hat, but they stress that these are not complete mitigations – https://access.redhat.com/security/vulnerabilities/RHSB-2026-016