Global – November 05, 2026 -- CIQ patched every affected kernel stream, more than a dozen across three major releases, within 72 hours of the first customer report on critical Linux vulnerability CVE-2026-98432, which carries a CVSS score of 9.8. The first fixed kernels reached CIQ repositories about 45 hours after the first customer questions.
Anthropic exploit demonstration raised the vulnerability's priority
On Tuesday, October 27, Anthropic reported a working proof-of-concept exploit for the flaw. Many CVEs are patched without proof of exploitability, so a demonstrated exploit raised the priority beyond what the severity score alone indicated. The kernel's CVE Numbering Authority assigned the 9.8 score.
The bug is a use-after-free in the Linux kernel's IPv4 TCP code, triggered by IP options on incoming connections. A network-based attacker can exploit the kernel's continued use of memory it has already released.
CIQ published mitigation guidance 16 hours after the first customer questions
The first customer questions arrived mid-afternoon on Thursday, October 29. Support and kernel teams confirmed the affected streams and opened a tracking escalation that afternoon. On Friday morning, CIQ published a knowledge base article explaining how to block the attack at the network layer until a reboot is possible.
By Friday evening, kernel engineers had backported the upstream fix to every affected kernel line, reviewed each change and queued all of them for build and signing.
First patched kernels went live Saturday for RLC Pro 8, 9 and 10
At about noon on Saturday, October 31, patched kernels went live for Rocky Linux from CIQ Pro (RLC Pro) 8, 9 and 10, plus RLC Pro LTS 8.6 and 9.2. LTS 9.6 followed a few hours later. FIPS-compliant 9.2 and 9.6 were also patched Saturday. FIPS-compliant 8.6 and 8.10 followed on Sunday.
The fixes cover the RLC+, RLC Pro, RLC Pro Hardened and RLC Pro AI editions built on those kernels. CIQ Linux Kernel (CLK) 6.18 builds released on October 16 and 21 already contained the upstream fix, so those customers needed no new patch.
CIQ shared patches with the Rocky Enterprise Software Foundation
CIQ gave its patches to the Rocky Enterprise Software Foundation (RESF). The foundation published a fixed kernel for the Rocky Linux community in its optional security repository.
Validation, not code changes, consumed the weekend
CIQ described the backport itself as mechanical because the upstream patch is small. The time went into building, reviewing, signing, validating and publishing the streams, and into confirming the fix worked, introduced no regressions and stayed maintainable. A small kernel team handled the work over the weekend and moved the CVE ahead of the rest of its queue.
CIQ says every backport was reviewed, signed and given an extra validation round before release. Customers must update the kernel and reboot, because the old kernel keeps running until restart. Those who cannot reboot immediately should follow the mitigation in the knowledge base article.