CVE-2026-98432 is a use-after-free bug in the Linux kernel’s IPv4 TCP handshake. Anyone who can send a SYN to a listening port can reach it. Your application never sees a single byte. The bug goes back to Linux 4.4. The upstream fix has been out since mid-October. Ubuntu and Red Hat still haven’t shipped one.