Our kernel team spent the last weekend of October shipping patched kernels for a critical Linux CVE.
On Tuesday, October 27, Anthropic reported a working proof-of-concept exploit for CVE-2026-98432. CVEs are often discovered and patched without proof that they can actually be exploited. Anthropic had demonstrated a working exploit, raising its priority even beyond what the severity score alone indicated.
The vulnerability is a use-after-free in the Linux kernel's IPv4 TCP code, triggered by IP options on incoming connections. In plain terms, the kernel can keep using a piece of memory after it has already released it, and an attacker on the network can take advantage of that. It received a critical CVSS score of 9.8 from the kernel's CVE Numbering Authority.
Here’s what we did, how long it took, and what it means for anyone running CIQ kernels.
The highlights
- Guidance first. Mitigation guidance was published the next morning, about 16 hours after the first customer questions. It covers how to block the attack at the network layer until a reboot is possible.
- First patches in 45 hours. The first patched kernels landed in our repositories on Saturday, October 31, about 45 hours after the first report.
- Every stream in three days. Within 72 hours, every affected kernel stream we listed was patched: RLC Pro (Rocky Linux from CIQ Pro) 8, 9, and 10; our FIPS-compliant kernels for RLC Pro LTS 8.6, 9.2, and 9.6. That included the RLC+, RLC Pro, RLC Pro Hardened, and RLC Pro AI editions built on them.
- LTS and FIPS included. LTS 8.6, 9.2, and 9.6, along with FIPS-compliant 9.2 and 9.6, were patched on Saturday. FIPS-compliant 8.6 and 8.10 followed on Sunday.
- Already protected. CIQ Linux Kernel (CLK) 6.18 builds released on October 16 and 21 already contained the upstream fix, so customers on those kernels did not need to wait for a new patch.
How it played out
Tuesday, October 27. Anthropic published a blog about how its tools were finding vulnerabilities, proving exploits, and proposing fixes, including CVE-2026-98432. Our kernel team began evaluating the vulnerability and its impact on our kernel streams.
Thursday, October 29. The first customer questions came in mid-afternoon, and more followed through the evening. Our support and kernel teams confirmed which of our kernel streams were affected and opened a tracking escalation the same afternoon.
Friday, October 30. We published a knowledge base article with mitigation steps first thing in the morning. Our kernel engineers backported the upstream fix to every affected kernel line, reviewed each change, and got all of them into the build and signing queue by Friday evening.
Saturday, October 31. At about noon, the first patched kernels went live in CIQ repositories for RLC Pro 8, 9, and 10 with RLC Pro LTS 8.6 and 9.2. with 9.6 arriving a few hours later. We also shared our patches with the Rocky Enterprise Software Foundation (RESF), which published a fixed kernel for the Rocky Linux community in its optional security repository.
Why it went this fast
Backporting this particular fix was mechanical; the upstream patch is small. The time goes into everything around it: building, reviewing, signing, validating, and publishing more than a dozen kernel streams across three major releases. Ensuring that the vulnerability is actually fixed, no regressions were introduced, and that the fix will be maintainable. A small team did all of that over a weekend. They put this CVE ahead of everything else in their queue because our customers needed it there.
Count on CIQ when it matters
This weekend showed what CIQ customers get when a critical kernel CVE lands:
- Guidance before patches. Mitigation steps were published about 16 hours after the first customer questions, so you could block the attack at the network layer until a reboot was possible.
- Speed across every stream. More than a dozen kernel streams across three major releases, including LTS, FIPS-compliant kernels, and the Plus, Pro, Hardened, and AI editions, were patched within about three days.
- Validation before release. Every backport was reviewed, signed, and put through an extra round of validation before it reached your repositories.
- A team that puts you first. Our kernel team moved this CVE to the front of the queue and worked through the weekend because customers needed it.
- Support for the wider community. We shared our patches with the RESF, which published a fixed kernel for the Rocky Linux community.
Update and reboot now
Update your kernel and reboot. That second step matters: until you reboot, the old kernel is still the one running. The fixed versions are below. If you can’t reboot right away, follow the mitigation in our knowledge base article.
| Rocky Linux from CIQ (RLC) | Fixed in |
|---|---|
| Pro 8 | kernel-4.18.0-553.178.1+2.1.el8_10_ciq |
| Plus 9 | kernel-5.14.0-687.60.1+2.1.el9_8_ciq |
| Pro 9 | kernel-5.14.0-687.60.1+2.1.el9_8_ciq |
| Pro Hardened 9 | kernel-5.14.0-687.60.1+2.1.el9_8_ciq |
| Pro AI 9 | kernel-clk6.18-6.18.56-1.1 |
| Plus 10 | kernel-6.12.0-211.68.1+2.1.el10_2_ciq |
| Pro 10 | kernel-6.12.0-211.68.1+2.1.el10_2_ciq |
| Pro AI 10 | kernel-clk6.18-6.18.56-1.1 |
| Pro LTS 8.6 | kernel-4.18.0-372.32.1+40.1.el8_6_ciq |
| Pro LTS 8.10 | kernel-4.18.0-553.178.1+2.1.el8_10_ciq |
| Pro LTS 9.2 | kernel-5.14.0-284.30.1+45.1.el9_2_ciq |
| Pro LTS 9.6 | kernel-5.14.0-570.60.1+27.2.el9_6_ciq |
| Pro Hardened LTS 9.6 | kernel-5.14.0-570.60.1+27.2.el9_6_ciq |
| Pro LTS 10.2 | kernel-6.12.0-211.68.1+2.1.el10_2_ciq |
| Pro Hardened LTS 10.2 | kernel-6.12.0-211.68.1+2.1.el10_2_ciq |
If you’re on a CIQ product not listed here, or you have questions about your environment, open a support ticket and we’ll take it from there.
