TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The Linux kernel CNA rates CVE-2026-98432, a remotely reachable IPv4 TCP use-after-free, Critical with a CVSS 3.1 score of 9.8. Upstream fixes have shipped across supported kernel lines, but Ubuntu and Red Hat Enterprise Linux still listed affected releases without fixes as of Oct. 31, 2026; distribution status varies.
The Linux kernel’s CVE Numbering Authority has rated CVE-2026-98432 Critical, assigning a CVSS 3.1 score of 9.8 to a use-after-free in IPv4 TCP connection handling that can be reached by a remote, unauthenticated peer. Upstream fixes are available for several kernel branches, but Ubuntu and Red Hat Enterprise Linux still listed affected releases without a fix as of Oct. 31, 2026, leaving administrators to check their distribution’s status rather than rely on upstream version numbers.
The flaw concerns IPv4 option data used while the kernel processes a TCP handshake. The Linux CNA’s scoring notes describe possible disclosure of kernel heap contents, memory corruption or a system crash. Red Hat’s bulletin says a remote attacker could exploit a race condition during TCP connection-request processing to trigger remote code execution. These are vulnerability impact assessments; the source material does not report confirmed attacks in the wild.
Upstream fixes arrived in stages: versions 7.2.10 and 6.18.56 on Oct. 11; 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272 on Oct. 15; and 7.3 on Oct. 18. The issue dates back to Linux 4.4, according to the report. Older upstream branches that reached end of life before 5.10 are not receiving upstream fixes, though distributions may maintain their own patches.
Distribution status differs. The report’s Oct. 31 check found Ubuntu’s tracker marked its Linux package vulnerable across releases, with work in progress listed for several versions. Red Hat listed RHEL 8, 9 and 10 as affected with no fix and said it was expediting fixes. AlmaLinux had candidate kernels in testing. By contrast, the report lists fixes for Debian releases, Amazon Linux kernels and some SUSE products; Oracle Linux had issued errata for its Unbreakable Enterprise Kernel.
Patch Status Differs by Linux Distribution
The high score reflects a flaw in kernel-level network processing, before an application handles an incoming IPv4 TCP connection. A service exposed to the network may therefore depend on the host kernel’s patch status, not just the security of the application listening on a port. The CNA’s score specifies network access, low attack complexity, no privileges and no user interaction; it rates potential confidentiality, integrity and availability impacts as high.
For operators, the immediate practical issue is that a single upstream release number does not establish whether a distribution has fixed the flaw. Vendors can backport patches without adopting the upstream version number, while packages based on the same kernel family may have different status. Administrators should consult the advisory and package tracker for their specific operating system and kernel variant.
Containers do not remove the host-kernel exposure described in the report: containers share the host kernel, so replacing a container image alone does not apply a kernel fix. The source identifies IPv4 as the affected path and says the main issue does not affect IPv6 connections. That distinction does not substitute for checking which network services and kernel configurations are in use.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Upstream Fixes and Vendor Advisories
The Linux kernel CNA assigned the CVE and published the record on Oct. 15, 2026. The report credits Anthropic researcher Xinyang Ge with reporting the issue and says Eric Dumazet prepared the fix, reviewed by Kuniyuki Iwashima. Red Hat raised its assessment from Important, with a score of 8.1, to Critical 9.8 on Oct. 30. Other vendor ratings differ: the supplied material says SUSE rates it Important, Ubuntu High, and Oracle and Amazon Important at 8.1.
Anthropic says its Claude model produced a working proof-of-concept exploit that runs commands as root on Linux servers with a multipath TCP listener and requires no credentials. The exploit has not been published, according to the report. The Go Security Team is cited as saying Go programs open multipath TCP listeners by default. These details indicate a potentially relevant configuration, but do not establish that every Linux server or Go application is exploitable.
The upstream fix is described as a four-line change, but distribution packages may carry the correction under their own release numbering. The report says the National Vulnerability Database entry was still marked “Received,” without its own analysis, at the time of its Oct. 31 check. It also says no Ubuntu Security Notice had been published by then.
“A remote, unauthenticated attacker could exploit a race condition during TCP connection request processing to trigger remote code execution.”
— Red Hat security bulletin
Exploitability and Patch Timing
The supplied material does not establish whether the reported proof of concept has been independently verified, whether it has been used outside testing, or whether attackers are exploiting the flaw. Anthropic has not published the exploit, and the report gives no confirmed incident data. The potential for remote code execution is attributed to Red Hat’s assessment and Anthropic’s proof-of-concept claim.
Patch availability remained unsettled for some systems at the Oct. 31 check. Ubuntu still marked releases vulnerable, Red Hat had not yet listed fixes for RHEL 8, 9 and 10, and AlmaLinux packages remained in testing. These are time-stamped statuses and may have changed since. The affected status of individual configurations, including whether a host has the relevant multipath TCP listener, also needs verification against vendor guidance.
The report says the issue affects IPv4 and that IPv6 is not affected by the main issue. It does not provide a full account of all configuration prerequisites or a definitive list of every affected vendor kernel. The NVD had not completed its own analysis at the stated check time.
Check Vendor Advisories for Fixes
Administrators should consult their distribution’s current CVE tracker and security advisories, then apply the vendor’s fixed kernel package when available. Because vendors backport changes, the relevant signal is the package status or advisory for the installed distribution and kernel flavor, not whether the version string matches an upstream release listed above. Systems that have installed a vendor fix should follow the vendor’s restart or kernel activation guidance.
Red Hat said it was expediting fixes, while AlmaLinux said its candidate packages would move from testing to production after community testing. Ubuntu’s tracker showed work in progress for some releases. Those updates, along with any new vendor bulletins and revised NVD analysis, are the next milestones for determining how quickly remaining affected systems can be patched.
Key Questions
What is CVE-2026-98432?
It is a Linux kernel use-after-free involving IPv4 option data during TCP connection handling. The Linux CNA assigned CVSS 3.1 9.8, Critical.
Does the flaw require an account or user interaction?
The CNA’s score lists network access, low attack complexity, no privileges required and no user interaction. The report describes it as reachable by a remote, unauthenticated peer; real-world exploitability can still depend on system configuration.
Which Linux versions have an upstream fix?
The report lists fixes from 5.10.272 through 7.3, including supported 5.15, 6.1, 6.6, 6.12, 6.18 and 7.2 branches. Distribution kernels may contain backported fixes under different version numbers, so check the vendor advisory.
Are containers affected?
The report says containers share the host kernel. Updating an image alone does not patch that kernel; operators need to check and update the host’s distribution package where required.
Is there a public exploit or confirmed attack?
Anthropic says its Claude model generated a working proof of concept for servers with a multipath TCP listener, but the report says the exploit has not been published. The supplied material does not confirm exploitation in the wild.
Source: atlasum.net
