A kernel panic screen illustrates the severity of the CVE‑2026‑98432 vulnerability affecting many Linux servers.
CVE-2026-98432 LINUX KERNEL USE-AFTER-FREE REACHES CRITICAL LEVEL
*A remote, unauthenticated attacker can trigger kernel memory corruption or remote code execution on any Linux server with a vulnerable kernel. Red Hat upgraded the rating to Critical on Oct 30; most major distros still lack patches.*
A critical Linux kernel flaw surfaced this month, and the clock is already ticking. CVE‑2026‑98432 lets an unauthenticated remote peer trigger a use‑after‑free during the IPv4 TCP handshake, potentially leaking kernel memory, corrupting the heap, or executing arbitrary code as root. The Linux kernel CNA rates the bug CVSS 9.8, and Red Hat upgraded its severity to Critical on Oct 30. While upstream kernels received a fix between Oct 11 and Oct 18, most production servers run distribution kernels that remain unpatched. Ubuntu lists every release as vulnerable, and Red Hat Enterprise Linux 8‑10 still lacks a fix. The exploit’s relevance spikes because Go programs open multipath TCP listeners by default, a condition Anthropic’s Claude model used to craft a remote‑root PoC. The vulnerability now sits in code every Linux server executes before any application sees the connection, making rapid mitigation essential.
What is CVE-2026-98432?
CVE-2026-98432 is a use‑after‑free bug in the IPv4 TCP handshake code. The kernel frees option data too early, allowing a remote peer to corrupt heap memory, disclose kernel contents, or crash the system. The Linux kernel CNA rates it CVSS 3.1 9.8, Critical. The upstream fix is a four‑line change applied to kernels 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3 between Oct 11 and Oct 18, 2026. The flaw exists in every Linux kernel from version 4.4 onward that lacks these patches, covering both bare‑metal servers and containers that share the host kernel.
Which distributions are patched and which remain vulnerable?
Debian’s Bookworm (6.1.190‑1) includes the fix. Current SUSE Enterprise, Oracle UEK, and Amazon Linux kernels also ship patched versions. Ubuntu’s tracker still marks every release vulnerable as of 5:15 PM CDT, Oct 31, with “work in progress” notes on several kernel series. Red Hat Enterprise Linux 8, 9 and 10 are listed as affected with no fix; Red Hat raised the severity to Critical on Oct 30 and promises an expedited release. AlmaLinux has backported kernels in testing but has not yet issued production errata. The upstream mainline kernels are fixed, but most servers run distribution kernels, so patch status varies widely.
Why does multipath TCP matter?
The proof‑of‑concept exploit described by Anthropic’s Claude requires a multipath TCP (MPTCP) listener. The Go Security Team confirms that Go programs enable MPTCP listeners by default, meaning many cloud services, containers and micro‑services inadvertently expose the vulnerable path. Anthropic reports the exploit runs commands as root with no credentials on any Linux server that has an MPTCP listener. No public exploit has been released, but the existence of a working PoC raises the threat level dramatically, especially for Go‑heavy stacks.
How can admins mitigate the risk right now?
Atlas recommends dropping TCP packets that carry IPv4 options as an interim rule. Disabling multipath TCP on hosts that do not need it removes the primary attack surface. Red Hat’s bulletin also offers an nftables mitigation that blocks the offending handshake pattern. Administrators should install any available patched kernel from their distro, reboot, and prioritize patching hosts that run MPTCP listeners. Until fixes land in Ubuntu and RHEL, the combination of packet filtering and MPTCP shutdown is the only practical defense.
Frequently asked questions
Which Linux kernel versions are vulnerable to CVE-2026-98432?
All kernels from version 4.4 up to, but not including, the patched releases 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3 are vulnerable.
What immediate mitigations can be applied before patches are available?
Drop TCP packets carrying IPv4 options, disable multipath TCP if not needed, and use the nftables rule suggested by Red Hat to block the offending handshake.
Why does the exploit require a multipath TCP listener?
Anthropic’s proof‑of‑concept runs on Linux servers that have a multipath TCP listener; Go programs enable such listeners by default, making the condition common and the exploit feasible.
The window for a silent takeover is closing fast. Administrators must either apply the limited patches already available or deploy the recommended packet‑filter and MPTCP shutdown mitigations. With cloud providers and container hosts all sharing the same vulnerable kernel, any delay invites a wave of remote code execution attacks. The next patch cycle will determine whether the industry can close the gap before attackers turn the proof‑of‑concept into a weapon.
Sources: Hacker News article, Atlas blog (https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf)