The Linux kernel scored its own bug 9.8, and published the reasoning
2026-11-04Security
CVE-2026-98432 is a use-after-free in the IPv4 TCP path, reachable with a SYN packet carrying an IP option almost nobody uses. The only score on the record is the kernel's own, and it comes with a justification for every metric.