Linux kernel bug CVE-2026-98432: am I affected, and what should I do while Ubuntu and Red Hat finish fixes?
Quick answer
CVE-2026-98432 is a use-after-free bug in the Linux kernel’s IPv4 TCP handshake code that has been there since kernel 4.4 (Linux kernel CVE team). Red Hat calls it Critical: a remote attacker with no login could trigger it with precisely timed network requests (Red Hat RHSB-2026-016). Debian, SUSE, Oracle Linux and some Amazon Linux kernels already have fixes. As of Oct 31, 2026, Ubuntu’s main kernels were still marked “vulnerable, work in progress” (Ubuntu) and Red Hat said it is “expediting the release of fixes.” If you run a Linux box that accepts connections from the internet, check your kernel and install the fix the day your distro ships it.
Am I affected?
Who’s affected
- Linux servers and home-lab boxes that accept inbound TCP connections over IPv4, running a kernel without the fix. Red Hat: “Systems accepting inbound TCP connections are most directly exposed” (Red Hat).
- Ubuntu 22.04, 24.04, 26.04 and 26.10: fixed kernels in progress, not released yet. 16.04, 18.04 and 20.04 are listed as vulnerable (Ubuntu).
- RHEL 8, 9 and 10, plus OpenShift and other products on the RHEL kernel: affected; RHEL 7 is not (Red Hat; ctxsec).
- Not affected by this bug: IPv6 TCP, per the kernel announcement. Phones, Windows PCs and Macs are not running the Linux server kernel this is about.
How to check (60 seconds)
- Run
uname -rto see your kernel version. - Upstream fixes landed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10 (Linux kernel CVE team). Distro kernels use their own numbers, so check your distro’s page for the CVE, not just the number (Ubuntu).
- Only a “Fixed” or “Released” status means an update is actually available.
What to do
- If your distro has a fixed kernel (Debian, SUSE, Oracle, some Amazon Linux 2023), install it and reboot. The fix isn’t active until you do (Kudelski Security).
- On Ubuntu or RHEL, watch the vendor page and patch internet-facing machines first when kernels ship.
- Meanwhile, cut exposure: close ports you don’t need, and keep home-lab services behind your router or a VPN rather than open to the internet (Kudelski Security).
- Admins: Red Hat publishes an nftables rule that drops incoming IPv4 TCP packets carrying IP options. It “reduces exposure … but cannot fully prevent it,” so test it first and remove it after patching (Red Hat).
What happened
- Oct 15: the Linux kernel CVE team announced the bug and its upstream fixes (announcement).
- Oct 27: Anthropic said an internal Claude model built a root exploit against servers with a multipath TCP listener (ctxsec; our Oct 28 story).
- Oct 30: Red Hat published security bulletin RHSB-2026-016 rating it Critical and “expediting” fixes (Red Hat).
- Oct 31: Ubuntu’s tracker still showed fixes in progress for its supported releases (Ubuntu).
Why it matters
- TCP is how almost every network service talks, so the exposed surface is broad. Exploiting it takes precise timing, but no password and no user click (Red Hat).
- Severity ratings differ: the kernel CVE team scores it 9.8; Red Hat’s bulletin says Critical. Treat it as patch-promptly either way.
FAQ
- Is my home router or NAS affected? Many run Linux, but whether a given device is vulnerable depends on its kernel and vendor. Check for firmware updates from the maker.
- Is there a fix for Ubuntu? Not as of Oct 31, 2026; Ubuntu lists fixes as work in progress.
- Do I need to reboot? Yes. A new kernel only protects you after a reboot.
- Is this being exploited in the wild? None of the vendor pages we checked say so. A working exploit has been described publicly by Anthropic.