--- title: "Linux Kernel Vulnerability CVE-2026-98432: Are You Exposed?" url: https://syntaxradar.com/radar/linux-kernel-vulnerability-cve-2026-98432 author: "Abdul Rehman, Lead Systems Architect and Technical Director" publishedAt: 2026-11-02T05:00:00.000Z dateModified: 2026-11-02T05:00:00.000Z category: "#DEV-SYSTEMS" topic: "linux kernel vulnerability" primarySource: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/98xxx/CVE-2026-98432.json summary: "Linux kernel vulnerability CVE-2026-98432 scores 9.8 and reaches back to kernel 4.4. See if your server is affected, which kernels fix it and how to mitigate." --- # Linux Kernel Vulnerability CVE-2026-98432: Are You Exposed? **Short answer:** CVE-2026-98432, a use-after-free in how Linux handles IPv4 options during the TCP handshake, was published on October 15. The kernel CNA and Red Hat score it 9.8 Critical. Fixed stable kernels exist, but RHEL and Ubuntu had no fix as of October 31. **Takeaway:** Install your distribution's fixed kernel and reboot every Linux host, including Kubernetes nodes, as soon as packages land, and use Atlas's lab-tested firewall and MPTCP stopgaps only as a bridge. **Key figures (as reported by the source):** - CVSS 3.1 score (Linux CNA, Red Hat): 9.8 Critical - First affected kernel: Linux 4.4 - Reported exploit time to kernel pointer leak: About 48 minutes A new Linux kernel vulnerability, CVE-2026-98432, carries a 9.8 out of 10 severity score from the Linux kernel's own CVE team, and it sits in the part of the kernel that answers incoming TCP connections. The flaw is a use-after-free bug, and it reaches back to Linux 4.4, so a long run of kernel versions is in scope until patched. Fixed kernels exist for most stable branches. The catch is that several big distributions had not shipped them as of October 31, and installing one means a reboot. If you run Linux servers, this week's work is checking versions, planning reboots and deciding whether an interim firewall rule is worth the risk. ### What the Linux kernel vulnerability CVE-2026-98432 is CVE-2026-98432 is a memory-safety bug in how Linux handles IPv4 options while setting up a TCP connection. According to the [official CVE record](https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/98xxx/CVE-2026-98432.json), the record was reserved on September 25, published on October 15 and last updated on October 31. Its title describes the fix: "ipv4: free inet_opt and ireq_opt after an RCU grace period." Those two names, inet_opt and ireq_opt, are where the kernel stores IP options for a socket and for a pending connection request. IP options are rarely used extra fields that can ride in the header of an IPv4 packet. The record says the kernel could free that memory while code building a SYNACK (the server's reply in the TCP handshake) was still reading it. The affected code lives in net/ipv4/af_inet.c and tcp_ipv4.c. The Linux kernel CNA, the body that issues CVEs for the kernel, scores it CVSS 3.1 9.8, Critical, the top band of the scale. The vector string, AV:N/AC:L/PR:N/UI:N, translates to: reachable over the network, low attack complexity, no privileges needed, no user interaction needed. That combination is what pushes a score toward the top of the scale. According to [Atlas's write-up](https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf), the bug was reported by Xinyang Ge of Anthropic and fixed by Eric Dumazet. The fix commit, e3f33b0, was posted on October 1 and merged on October 5, ten days before the CVE went public. ### What is a use after free vulnerability? A use after free vulnerability (also called a use-after-free bug) happens when a program hands a piece of memory back to the system, then keeps using it anyway. Here is the idea in everyday terms: you return a hotel key card at checkout while a friend still has a copy. The hotel gives the room to a new guest, and your friend walks in on someone else's belongings. In a bug like this one, that "new guest" can be data an attacker arranged to place there. If code reads freed memory that now holds attacker-chosen bytes, it may follow a bogus pointer or act on fake values. In the worst cases, that gives an attacker control of the kernel itself, which means full control of the machine. The kernel has a standard tool for this kind of timing problem, called RCU (read-copy-update). With RCU, code that wants to free shared data waits for a "grace period": a window long enough that every reader who might still be looking at the old data has finished. The fix for this bug does exactly that. It switches the freeing of the IPv4 options to kfree_rcu(), so the memory is released only after readers are done with it. ![Linux kernel vulnerability diagram showing how a use after free in the TCP handshake works: options stored, memory freed too early, a reader still using it, and the kfree_rcu fix](/uploads/blog/linux-kernel-vulnerability-cve-2026-98432/img1.webp) ### How serious is CVE-2026-98432? On paper, very. The 9.8 score from the kernel CNA matches [Red Hat's CVE page](https://access.redhat.com/security/cve/CVE-2026-98432), which rates it Critical with a preliminary 9.8 and points customers to bulletin RHSB-2026-016 for mitigation steps. Atlas reports that Red Hat raised its rating to Critical on October 30, up from Important at 8.1. The real-world signal is the exploit work. According to Atlas, Anthropic says its Claude model built a working root exploit against servers that have an MPTCP listener running. MPTCP (Multipath TCP) is an extension that lets one connection use several network paths at once. Anthropic's reported timeline was about 48 minutes to leak a kernel pointer, then about 5 more minutes to reach shell execution. The exploit has not been published. Some signals are calmer. As of October 31, Atlas notes, the bug was not in CISA's Known Exploited Vulnerabilities catalog, and the NVD listed its status as "Received," meaning the NVD had not yet published its own analysis. You may also see a much lower number. Wiz's [vulnerability database page](https://www.wiz.io/vulnerability-database/cve/cve-2026-98432) lists the bug as Medium, 5.9. That page is AI-generated and conflicts with both the kernel CNA and Red Hat, so treat its score and its suggested workaround with caution. For patch priority, go with the two primary scores. ### Is my Linux server affected? Your Linux server is affected if it runs a kernel from version 4.4 onward that does not yet include the fix. The CVE record lists these fixed releases:
Kernel branchFirst fixed version
5.10 stable5.10.272
5.15 stable5.15.223
6.1 stable6.1.190
6.6 stable6.6.159
6.12 stable6.12.113
6.18 stable6.18.56
7.2 stable7.2.10
Mainline7.3
Run `uname -r` to see your kernel version. One warning: distributions backport fixes into their own kernel builds, so the version number alone can mislead on Red Hat, Ubuntu and similar systems. Check your vendor's tracker for the exact package. Here is where the major distributions stood, according to Atlas, as of October 30 and 31: - **Red Hat:** RHEL 8, 9 and 10, plus OpenShift 4 and 5, are affected with no fix yet. RHEL 6 and 7 are not affected. - **Ubuntu:** the tracker lists kernels as Vulnerable on every release, with no Ubuntu Security Notice yet. - **Debian:** fixed in bookworm (6.1.190-1 and 6.12.113-1~deb12u1) and trixie (6.12.113-1). - **Amazon:** says all its kernels are fixed as of October 30. - **AlmaLinux:** fixed kernels have been in testing since October 30. Also check for MPTCP listeners with `ss -Mlnp`, since that is the setup Anthropic's reported exploit targeted. Atlas flags a trap here: Go 1.24 and later enable MPTCP on listeners by default, so a Go service you never thought about may have one open. ![Checklist for finding out if your Linux server is affected: kernel version, distro tracker, MPTCP listeners, then patch and reboot](/uploads/blog/linux-kernel-vulnerability-cve-2026-98432/img2.webp) ### How to patch Linux kernel systems for CVE-2026-98432 Patching takes three steps: install your distribution's fixed kernel package, reboot, then confirm the running version. The reboot is the part teams skip. Atlas stresses that the update needs one on every machine, including container hosts and Kubernetes nodes. Containers share the host's kernel, so patching images does nothing for this bug. If you build your own kernels, move to the fixed release on your branch from the table above. If you run Debian bookworm or trixie or Amazon's kernels, the fix is available now. On RHEL, Ubuntu and AlmaLinux, watch the vendor channels and plan a reboot window for when packages land. A rolling drain-and-reboot of Kubernetes nodes is easier to schedule today than in a hurry later. #### Interim mitigations before a patch lands Atlas suggests two stopgaps. Both are lab-tested by Atlas only and are not official vendor guidance, so test them on a staging machine before production. Red Hat customers should read RHSB-2026-016 first. 1. **Drop IPv4 TCP packets that carry IP options.** Atlas uses an nftables rule matching `ip hdrlength gt 5`. A plain IPv4 header is five 32-bit words, so anything longer carries options, which ordinary traffic rarely needs. The rules last only until the next reboot, so they need re-applying if a machine restarts before it is patched. 2. **Turn off MPTCP if you do not use it.** Set `net.mptcp.enabled = 0` with sysctl. That removes the listener type the reported exploit relied on, though it does not fix the underlying bug. Neither step replaces the kernel update. They buy time on machines you cannot reboot this week. If you are auditing dev machines and servers anyway, our guide to the [Claude Code extension VSCode backdoor](/radar/claude-code-extension-vscode-backdoor) covers another check worth adding to the same pass. ### What to watch next Three updates will tell you how urgent this Linux kernel vulnerability becomes. First, Red Hat and Ubuntu shipping fixed kernels: once they land, the remaining excuse for waiting is the reboot. Second, CISA's KEV catalog: an entry there would mean evidence of exploitation in the wild. Third, the NVD's own score, which will show whether NIST sides with the 9.8 from the kernel CNA and Red Hat. Anthropic's exploit remains unpublished. Until fixed kernels are installed and machines rebooted, the safest plan is to treat every exposed Linux server as a target and use the interim rules only as a bridge. ## Frequently asked questions ### What is CVE-2026-98432? CVE-2026-98432 is a Linux kernel use-after-free bug in how IPv4 options are freed while the kernel builds a SYNACK reply during the TCP handshake. It affects kernels from 4.4 up to the fixed releases. The kernel's CVE team and Red Hat both score it 9.8, Critical, because the vector allows network access with no privileges. ### What is a use after free vulnerability? A use after free vulnerability happens when a program frees memory and keeps using it. In CVE-2026-98432, the kernel could free IPv4 options memory while code building a SYNACK reply was still reading it. The fix switches the freeing to kfree_rcu(), which waits for a grace period so readers finish first. ### Is my Linux server affected? Your server is affected if it runs Linux 4.4 or later without the fix. Fixed stable versions include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10, plus mainline 7.3. Distributions backport fixes, so check your vendor's tracker as well as the output of uname -r. ### How to patch Linux kernel systems for CVE-2026-98432? Install your distribution's fixed kernel package, reboot, then confirm the running version with uname -r. The reboot is required on every machine, including container hosts and Kubernetes nodes, because containers share the host kernel. As of October 31, Debian and Amazon had fixes, while RHEL and Ubuntu did not yet. ### Is there a workaround until a patched kernel arrives? Atlas suggests dropping incoming IPv4 TCP packets that carry IP options with an nftables rule matching ip hdrlength gt 5, and disabling MPTCP with net.mptcp.enabled = 0 if unused. Atlas lab-tested these only; they are not vendor guidance, and the firewall rules vanish at reboot. Red Hat users should follow bulletin RHSB-2026-016. ## Source Based on the CVE record, Red Hat's advisory and Atlas's write-up. https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/98xxx/CVE-2026-98432.json --- Published on SyntaxRadar (https://syntaxradar.com). Canonical URL: https://syntaxradar.com/radar/linux-kernel-vulnerability-cve-2026-98432. Last modified 2026-11-02T05:00:00.000Z.