RedHat's web site shows it as a 9.8 at https://access.redhat.com/security/cve/cve-2026-98432. Now, there may be times when Redhat downgrades a score...say for example you have SELinux and the vulnerability is blocked by it but they usually track with the official number.