https://www.solosoft.dev/tags/vulnerability-disclosure/Recent content in Vulnerability Disclosure on SoloSoftHugoen-usSun, 01 Nov 2026 00:00:00 +0000https://www.solosoft.dev/post/cve-2026-98432-two-statement-patch-five-vendor-scores/Sun, 01 Nov 2026 00:00:00 +0000https://www.solosoft.dev/post/cve-2026-98432-two-statement-patch-five-vendor-scores/<p>On 15 October 2026 the Linux kernel&rsquo;s own CVE Numbering Authority published CVE-2026-98432, &ldquo;ipv4: free inet_opt and ireq_opt after an RCU grace period&rdquo;, and scored it <strong>9.8, Critical</strong>, vector <code>AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</code>. By the end of October the same bug was rated <strong>8.1</strong> by Oracle and Amazon, <strong>Important</strong> by SUSE, <strong>High</strong> by Ubuntu — whose own page prints &ldquo;9.8 · Critical&rdquo; two lines above its priority — and <strong>9.8 Critical</strong> again by Red Hat, which had been sitting at 8.1 until it changed its mind on 30 October.</p> <p>The patch itself is two statements. Eric Dumazet&rsquo;s commit, authored 1 October and merged to stable on 15 October by Greg Kroah-Hartman, touches two files with <code>+2 −2</code>:</p>