CVE-2026-98432: A Critical Linux Kernel Bug and What Sysadmins Should Do Now

Status note: patch information below reflects reports from October 30 to November 1, 2026. Check your distribution's tracker before acting, because this changes quickly.

What happened

In October 2026, a critical Linux kernel vulnerability, CVE-2026-98432, was disclosed. It is a use-after-free bug in the kernel's IPv4 TCP code, specifically in how the kernel handles incoming connection requests during the TCP handshake. The Linux kernel CVE team rates it 9.8 out of 10.

The bug is a race condition. Two CPUs can process related request and child sockets at the same time while both still refer to the same IP options object. One side frees it, the other keeps using it.

Researchers at Anthropic reported that they built a working exploit that gives remote root access, without authentication, on a server running a Multipath TCP (MPTCP) listener. They also said the full chain took about 53 minutes to produce.

Why you should care, and why you shouldn't panic

Reasons to take it seriously:

• It affects kernels going back to version 4.4.
• No login is needed. The bug is reachable during the handshake.
• Ubuntu and RHEL had not shipped fixes at the time of the first reports.

Reasons not to panic:

• The public exploit demonstration targeted servers with MPTCP listeners, which is an uncommon setup on most hosts.
• Remote code execution has not been publicly shown on servers without an MPTCP listener, although the bug itself is in ordinary TCP code.
• Exploit code has not been published, and there were no confirmed reports of attacks in the wild.
• The severity score is disputed. The kernel team gives 9.8, while some vendors, such as Red Hat, rate it lower because the race is hard to win.

One detail that surprises people: since Go 1.24, Go programs enable MPTCP by default on TCP listeners when the kernel supports it. A Go service may have an MPTCP listener without the admin ever turning it on.

Who is affected

According to reports at the time of writing:

• Debian 12 and 13: fixed (kernel 6.1.190-1 and 6.12.113-1).
• Ubuntu 22.04, 24.04, 26.04, 26.10: listed as vulnerable, fix in progress.
• RHEL 8, 9, 10 (and Rocky): affected, fix pending. RHEL 7 is not affected.
• Oracle Linux, Amazon Linux, SUSE: fixes released for some kernels.
• macOS is not affected, since it does not use the Linux kernel.

What to check on your system

Check the running kernel:

uname -r

Check whether MPTCP is allowed on the host:

sysctl net.mptcp.enabled

A value of 1 means MPTCP sockets can be created. It does not mean any program is using it.

See which services are listening, and think about which ones are exposed to the internet:

sudo ss -tlnp

Install the vendor kernel update as soon as one is available, then reboot into it:

sudo apt update && sudo apt upgrade   # Debian/Ubuntu
sudo dnf upgrade --refresh            # RHEL family
sudo reboot
uname -r                              # confirm the new kernel is running

If there is no patch for your distro yet

• Limit who can reach your servers, especially internet-facing ones.
• Disable MPTCP if you do not need it, but understand that this does not remove the bug. The flaw can still be triggered through normal TCP traffic.
• Consider the temporary firewall rules published by the Rocky Linux support provider CIQ, which block IPv4 TCP packets carrying IP options. Read their guidance and test before applying it on production.
• Plan the reboot. A kernel patch does nothing until the new kernel is running.

Takeaways

1. A 9.8 score is a signal to look closer, not a reason to panic.
2. Knowing your exposure matters more than the score: which hosts are internet-facing, and what is listening?
3. Disabling a feature is not the same as fixing the bug.
4. Always verify with uname -r after the reboot.

Sources

• BleepingComputer, "Critical Linux kernel flaw allows remote root attacks on MPTCP servers" (October 30, 2026)
• Linux kernel CVE advisory for CVE-2026-98432
• Anthropic research report on the exploit
• Ubuntu, Red Hat, and Debian security trackers for CVE-2026-98432
• CIQ mitigation guidance for CVE-2026-98432

Disclosure: the exploit research behind this story was published by Anthropic. The original report is linked in the sources above.