TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Linux kernel CVE-2026-98432 is a use-after-free in IPv4 TCP connection processing, rated Critical with a CVSS 3.1 score of 9.8 by the kernel CNA. Upstream fixes are available for several kernel branches, but Ubuntu and RHEL still listed affected releases without fixes as of Oct. 31, 2026; distribution status varies.
Linux kernel maintainers have patched CVE-2026-98432, a use-after-free flaw in IPv4 TCP connection processing that can be reached by a remote, unauthenticated peer. The kernel’s CVE Numbering Authority (CNA) assigns it a CVSS 3.1 score of 9.8, Critical; however, several distribution trackers still showed affected systems without released fixes as of Oct. 31, 2026.
The flaw affects kernel code used while a server handles an IPv4 TCP connection request, before the connection reaches an application. The CNA’s scoring notes describe possible kernel memory disclosure, memory corruption or a system crash. Red Hat says exploitation of a race condition could lead to remote code execution, but that is its stated impact assessment, not a claim that widespread exploitation has been observed.
Upstream fixes were released in several branches: 7.2.10 and 6.18.56 on Oct. 11; 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272 on Oct. 15; and 7.3 on Oct. 18. The source report says the bug dates back to Linux 4.4. Branches older than 5.10 that have reached upstream end-of-life do not receive an upstream fix, though a distribution may issue its own patch.
Distribution versions do not necessarily match upstream kernel numbers because vendors backport changes. As of 5:15 p.m. CDT on Oct. 31, Ubuntu listed its kernel as vulnerable across releases, with some updates marked in progress. Red Hat listed RHEL 8, 9 and 10 as affected and said it was expediting fixes. Debian, Oracle Linux and Amazon Linux had published fixes for the releases described in the report; AlmaLinux fixes were in testing, while SUSE’s status differed by product and release.
Unpatched Servers Face Kernel-Level Risk
The issue matters because the vulnerable code runs in the kernel’s handling of incoming IPv4 TCP requests, not in a particular server application. That places the exposure at a shared system layer: updating an application or replacing a container image alone does not replace the host kernel. The report says containers use the host’s kernel, so operators need to check and patch the underlying system.
The CNA’s 9.8 Critical score reflects network reachability, low attack complexity, no required privileges or user interaction, and high potential effects on confidentiality, integrity and availability. That score indicates severity, not evidence that attacks are occurring. Administrators should use their operating system vendor’s advisory to determine whether a backported fix is installed, rather than relying only on the displayed upstream version.
Anthropic says its researcher reported the flaw and that its Claude model produced a working proof of concept for remote root access on servers with a multipath TCP listener. The company has not published that exploit, according to the report. The described condition makes multipath TCP configuration relevant to risk assessment, but the source does not establish that every vulnerable server is exploitable in the same way.
Products Worth Considering
Apple MacBook Air 13-inch with M5 chip, 16GB memory, 1TB SSD, and 12MP Center Stage camera (Midnight)
Apple Watch Series 12 GPS 46mm
Anker SOLIX C300 Portable Power Station, 288Wh
As an affiliate, we earn on qualifying purchases.
Fixes Differ Across Linux Distributions
The issue is recorded as “ipv4: free inet_opt and ireq_opt after an RCU grace period”. It concerns the lifetime of IPv4 option data during TCP handshake processing. The upstream repair is described in the source as a four-line change, but the small size of a patch does not mean every distribution can release it immediately: vendors test and package changes for their own supported kernels.
The Linux kernel CNA published the CVE record on Oct. 15, 2026. As of the report’s Oct. 31 check, the National Vulnerability Database entry was marked “Received” and had no independent analysis. Severity ratings also differ among vendors: Red Hat raised its rating to Critical, while SUSE called it Important, Ubuntu High, and Oracle and Amazon Important with scores of 8.1.
The report identifies Xinyang Ge of Anthropic as the reporter and credits Eric Dumazet with the fix, reviewed by Kuniyuki Iwashima. It says IPv6 is not affected by the main issue. These details narrow the stated scope, but do not substitute for checking vendor guidance on a specific product or configuration.
“Red Hat is expediting the release of fixes.”
— Red Hat, in bulletin RHSB-2026-016
Vendor Status and Exploit Scope
Distribution status is time-sensitive. The reported Ubuntu and RHEL entries reflect a check at 5:15 p.m. CDT on Oct. 31, not a guarantee that those systems remain unpatched now. Vendors can publish updates after that timestamp, and package status can vary across architectures, kernel flavors and supported product versions.
The source does not establish whether the flaw has been exploited in real-world attacks, how broadly a working exploit would apply beyond the multipath TCP listener scenario described by Anthropic, or whether additional configuration conditions are needed. Anthropic has not published its proof of concept, and the NVD had not completed its own analysis at the time reported. Operators should treat the severity and exposure claims as vendor and CNA assessments, not as confirmation of active attacks.
Check Advisories and Patch Availability
System administrators should consult the current security advisory for their exact distribution and kernel package, then install the vendor-provided fixed version when available. For Ubuntu and RHEL, the report’s Oct. 31 status showed fixes still pending; for AlmaLinux, packages were in testing. Those states may have changed, so operators should recheck the vendor tracker rather than rely on an older status snapshot.
Where a patch is not yet available, follow the vendor’s guidance on temporary mitigations and assess whether affected services expose IPv4 TCP or multipath TCP listeners. Red Hat’s bulletin included an nftables mitigation, but the source material does not provide its full procedure, so administrators should use the vendor instructions. The next developments to watch are updated distribution advisories, production release of pending packages, and any fuller technical analysis or exploit disclosure.
Key Questions
What is CVE-2026-98432?
It is a Linux kernel use-after-free involving IPv4 option data during TCP handshake processing. The kernel CNA rates it CVSS 3.1 9.8, Critical.
Can it be exploited remotely?
The CNA’s score identifies network access and no required privileges or user interaction. Anthropic says it developed a proof of concept for remote root access on servers with a multipath TCP listener. The source does not confirm widespread exploitation or that every affected configuration is exploitable in the same way.
Which Linux systems are affected?
The report says the flaw dates to Linux 4.4 and affects kernels without the fix. Distribution kernels may include backported patches under different version numbers, so check the operating system’s advisory rather than judging by the upstream version alone.
Are Ubuntu and RHEL fixed?
At 5:15 p.m. CDT on Oct. 31, 2026, Ubuntu listed its kernel as vulnerable across releases, while Red Hat listed RHEL 8, 9 and 10 as affected with no fix. These are dated status reports and may have changed; consult current vendor advisories.
Does the flaw affect IPv6 or container images?
The upstream commit says IPv6 is not affected by the main issue. A new container image alone does not update the host kernel; operators need to check and patch the underlying system according to their vendor’s guidance.
Source: atlasum.net
