iNBest
CVE-2026-98432Snapshot Oct 29–30, 2026Factual revision Oct 31, 2026Leap package review Oct 31, 2026Micro package review Oct 31, 2026

A flaw in Linux TCP.Ubuntu and RHEL still have no patch.

CVE-2026-98432 is a race condition in how the Linux kernel sets up IPv4 TCP connections. It has been there since Linux 4.4 (2016). Anthropic researchers showed it can lead to code execution as root on a server with an MPTCP listener. Debian, specific SUSE products and Oracle UEK have fixes. Amazon availability needs vendor verification. The reviewed Ubuntu and Red Hat records still list affected kernels without released fixes.

Book your free assessment What to do today
9.8
kernel CNA CVSS; Red Hat draft
8.1
SUSE, Amazon; Oracle preliminary
KEV
Not listed, catalog 2026-10-30; not proof of no attacks

Is your distribution patched?

Pick the one you run in production. Snapshot Oct 29–30; factual revision Oct 31, 2026.

Is your distribution patched?
No fixReviewed Oct 31, 2026

Base linux package: 22.04, 24.04, 26.04 and 26.10 in progress; 16.04, 18.04 and 20.04 vulnerable. Check each cloud, HWE, FIPS or real-time kernel separately.

What to do: Close TCP services that do not need to be on the internet and schedule the reboot window now.

Let us review your servers

[ 001 ]What happened

From the kernel fix to the demonstration.

  1. October 2026

    Kernel fix

    The fix waits for other CPUs to finish reading IP options before freeing them. The original snapshot gives Oct 5; the exact commit date remains unverified in this review.

  2. Oct 15

    CVE published

    CVE-2026-98432. Debian lists fixed security packages; its shipping dates remain unverified here. Oracle lists UEK errata dated Oct 16.

  3. Reviewed Oct 31

    Scores by issuer

    The kernel CNA scores it CVSS 9.8, as does Red Hat's draft. SUSE, Oracle and Amazon give 8.1; Oracle's score is preliminary.

  4. October 2026

    AI-written exploit

    Anthropic reports a working exploit: 48 minutes to leak a kernel address, 5 more to run commands as root. These are execution times, not writing time. The original Oct 27 publication date remains unverified here.

  5. Oct 30 snapshot

    Patch status

    Ubuntu base linux packages from 22.04 to 26.10 remain in progress. Red Hat lists RHEL 8, 9 and 10 as affected and is expediting fixes. Recheck vendor records before acting.

[ 002 ]How it works

A race inside the kernel.

The race, step by step
CPU 0CPU 1SYN with IPoptionsnew socketfrees optionsresends SYNreads optionsreads freedmemory
Two CPUs share a pointer to the same IP options. If one frees them while the other is still reading, the kernel uses freed memory.
  1. 01

    Connection with IP options

    The attacker opens a TCP connection to an exposed service with IPv4 Record Route or Timestamp options.

  2. 02

    Resend to win the race

    It resends the same request. The kernel handed the options to the new socket without copying them, and another CPU may still be reading them.

  3. 03

    Freed memory

    If the socket is destroyed while another CPU reads, the kernel uses freed memory (use-after-free).

  4. 04

    Leak and control

    In Anthropic's test, the leak exposed a kernel address that defeats KASLR, and a follow-on overflow ran code as root.

In Anthropic's demonstration, a lost race failed the handshake without crashing the system, allowing retries; other exploitation can crash the kernel. IPv6 is unaffected by the first issue, but the CVE identifies a separate CALIPSO/request-migration issue for another patch.

[ 003 ]Why the score varies

9.8 or 8.1? It depends on who you ask.

The kernel CNA and Red Hat's draft rate attack complexity low: CVSS 3.1 9.8. SUSE, Oracle and Amazon rate it high: 8.1. Oracle's score is preliminary. These are the records reviewed Oct 31, not proof of their historical scores. Check which Linux servers expose TCP services and how quickly you can patch and reboot them.

Kernel team (CNA)
9.8
Red Hat (draft)
9.8
SUSE; Oracle (preliminary)
8.1
Amazon
8.1
0510

[ 004 ]Status by distribution • Oct 30 snapshot, reviewed Oct 31, 2026

Is there a patch for yours?

DistributionStatusDetail
Ubuntu 22.04, 24.04, 26.04, 26.10No fixBase linux package in progress, high priority. Check cloud, HWE, FIPS and real-time packages separately.
Ubuntu 16.04, 18.04, 20.04No fixBase linux package vulnerable; check the exact kernel variant.
RHEL 8, 9, 10 and OpenShift 4No fixRed Hat lists them as affected. Check AlmaLinux and Rocky with their own vendors.
Amazon Linux 2 and AL2023VerifyVendor matrix lists fixes; base-kernel advisories have Oct 30 release dates but Nov 2 updates. Verify your kernel branch and repository availability.
SUSE productsPartialSLES 16.0 has released packages. Micro default/base fixes are not RT fixes: Micro 5.3 kernel-rt is affected and kernel-source-rt is in progress. Default: 5.3/5.4 list aarch64/s390x/x86_64; 5.5/6.2 list aarch64/ppc64le/s390x/x86_64. Base: 5.3–5.5 list aarch64/x86_64; 6.2 lists aarch64/ppc64le/x86_64, with separate RPM releases. RT: 5.4/5.5 list x86_64 only; 6.2 lists aarch64/x86_64. Match the exact advisory-listed build and architecture; unlisted combinations are unverified. Micro 6.0/6.1 remain affected. SP7 in progress. Leap 16.0 update openSUSE-Leap-16.0-1973 lists kernel-default 6.12.0-160000.40.1 for aarch64, ppc64le, s390x and x86_64. Other flavors and kernel-default-base have separate package/architecture entries. The CVE matrix still marks kernel-source affected: conflicting vendor records do not establish that every Leap system is fixed.
Debian 12 and 13Fixed6.1.190-1 and 6.12.113-1; Debian 12 also has 6.12.113-1~deb12u1. Needs security.debian.org in your sources.
Oracle Linux 7 to 10 (UEK)FixedELSA-2026-500397, 500398 and 500399, since Oct 16. Match your UEK generation and package.
RHEL 7Not affectedPer Red Hat.

Fixed upstream kernels: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Status changes daily; check your vendor's advisory. A matrix entry alone does not prove a package was available at the snapshot cutoff.

[ 005 ]What to do today

Inventory, patch, reboot, verify.

01

Take inventory

Every Linux server, VM, Kubernetes node and appliance. Containers use the host kernel, so the host is what counts.

02

Patch where you can

Debian, specific SUSE products and Oracle UEK have fixes. For Amazon, verify the advisory, kernel branch and repository availability before selecting a package. For Leap, match product, kernel flavor, RPM version-release, architecture and official repository to update 1973; reboot into the updated kernel and verify the running package. Source/development packages alone do not patch the running kernel. Check SP7 daily. For Micro, match product, default/base/RT flavor, full RPM version-release, architecture and official repository to its own advisory. Reboot into the updated kernel and verify the running package. Do not treat Micro 5.3 RT as fixed by a default/base update.

03

Reboot

A new kernel on disk protects nothing until the machine boots into it. Compare uname -r with the installed kernel.

04

Reduce exposure on Ubuntu and RHEL

Close unnecessary public TCP services and schedule the reboot window. Red Hat's official filtering guidance reduces exposure but cannot fully prevent the issue and may disrupt workloads. Test it first; it does not replace patching.

05

Check MPTCP listeners

Go 1.24 enables MPTCP by default for Linux listeners. GODEBUG=multipathtcp=0 changes that default, but per-socket APIs override it. The Go team calls this fragile and recommends a patched kernel; the underlying bug is not MPTCP-specific.

06

Watch kernel logs

Look for ip_options_build, ip_build_and_send_pkt or skb_under_panic in journalctl -k.

Quick check on each server
# Running kernel and pending reboot
uname -r
[ -f /var/run/reboot-required ] && echo "Reboot required"      # Debian/Ubuntu
needs-restarting -r                                          # RHEL

# Does the installed kernel include the fix?
apt changelog linux-image-$(uname -r) | grep CVE-2026-98432  # Debian/Ubuntu
rpm -q --changelog kernel-$(uname -r) | grep CVE-2026-98432  # RHEL

# MPTCP listeners and log signals
ss -Mlnp
journalctl -k | grep -E 'ip_options_build|ip_build_and_send_pkt|skb_under_panic'

[ 006 ]The iNBest assessment

Know what is exposed before someone else tests it.

Anthropic demonstrated remote root access with an AI-written exploit. Its 48-minute leak and 5-minute execution stages measure runtime, not development time. Our cybersecurity assessment starts with this flaw and leaves you with a clear map of your Linux risk.

How it starts

  1. 01

    30-minute call

    A security engineer reviews your Linux footprint and cloud.

  2. 02

    Scope

    We agree on systems, access and timing, in writing.

  3. 03

    Report

    List of exposed systems, what was patched or mitigated, and next steps.

Book your free assessment Try AIHACKERS online

Or email us at [email protected]

If iNBest already manages your infrastructure, we are already reviewing your systems and will contact you to confirm their status.

  • Linux inventory

    Servers, VMs, nodes and appliances with distribution, running kernel and installed kernel.

  • Exposure map

    Which TCP services answer from the internet, including MPTCP listeners.

  • Patch and reboot plan

    Ordered by risk, with reboot windows and tracking of Ubuntu and Red Hat advisories.

  • Controls until the patch ships

    Firewall and security group rules to close what should not be exposed.

  • Compromise review

    Kernel logs, processes, accounts and persistence on exposed machines.

  • AI pentest (optional)

    AIHACKERS tests your web apps and APIs with AI and delivers verified findings.

[ 007 ]Self-check

Five questions. Be honest.

Answer for your company. Nothing is sent.

We have a complete list of Linux servers, VMs and nodes, with the kernel each one runs.

We know which TCP services on those machines answer from the internet.

We can patch and reboot a production server in under 72 hours.

We have read our distribution's advisory for CVE-2026-98432.

We would notice an unexpected reboot or an odd kernel log error within hours.

0 of 5 answered

Answer all 5 to see your result.

Book your free assessment

[ 008 ]FAQ

What people ask us.

Is it being exploited?

CVE-2026-98432 is not listed in CISA KEV catalog 2026.10.30, released Oct 30. This does not establish absence of attacks, a zero attack count on Oct 29, or absence of public exploit code. Anthropic describes a working demonstration; keep checking authoritative updates.

Does it only affect servers with MPTCP?

Not necessarily. Anthropic's exploit targeted a server with an MPTCP listener, but neither the CVE nor the fix mentions MPTCP, and the Go team says the bug is not MPTCP-specific.

Are my containers affected?

Containers use the host kernel. The host or node is what needs patching and rebooting.

We only use IPv6. Are we safe?

The CVE says IPv6 is unaffected by the first issue because it copies the options, but identifies a separate CALIPSO/request-migration issue for another patch. This is not a blanket IPv6 safety claim. Check whether your systems also accept IPv4.

There is no Ubuntu patch. What do we do?

Close unnecessary public TCP services, prepare the reboot window and watch Ubuntu's exact kernel-package advisory. Red Hat provides filtering guidance that reduces exposure but cannot fully prevent the issue; test for workload disruption. Patching remains necessary.

Do you work in Mexico and the US?

Yes. iNBest has engineers in Mexico and the United States and works in Spanish and English.

[ 009 ]Sources

Primary records reviewed Oct 31, 2026. Mutable pages do not prove historical availability. Original secondary references are retained below for provenance, not as current vendor guidance.