CVE-2026-98432: Critical Linux TCP Bug and How to Patch It
Key points
- CVE-2026-98432 is a use-after-free in the Linux kernel’s IPv4 TCP code. It is reachable over the network, without authentication, during the TCP handshake.
- The kernel maintainers rate it critical (CVSS 9.8). The bug has been present since Linux 4.4.
- A remote root exploit has been demonstrated against servers with a Multipath TCP listener, and trigger code is public.
- Install your distribution’s fixed kernel and reboot. Disabling MPTCP is a temporary measure only.
Remote kernel bugs are rare. Most Linux kernel flaws need a local user before they can do any damage. CVE-2026-98432 is the exception that every internet-facing server has to take seriously, because the vulnerable code runs while a TCP connection is still being set up, long before SSH, a web server or any other service checks who is connecting.
What is CVE-2026-98432?
CVE-2026-98432 is a race condition in how the Linux kernel stores IPv4 options during the TCP handshake. When a SYN packet carries IP options such as Record Route or Timestamp, the kernel saves them and hands them to the new connection without making a copy. It can then free that memory while another CPU core is still reading it. That is a use-after-free.
An attacker who wins the race can make the kernel read freed memory. Depending on the system, the result is a leak of kernel memory, memory corruption, a crash, or code execution in the kernel. The fix is small: the kernel now waits until no CPU can still be using those options before releasing them.
How serious is it?
The kernel maintainers scored it 9.8 out of 10 (network attack, low complexity, no privileges, no user interaction). Some vendors rate it lower, around 8.1, because winning the race takes effort. Two facts matter more than the exact number:
- A working remote root exploit has been demonstrated against servers that run a Multipath TCP (MPTCP) listener. It has not been published.
- Code that triggers the race is available in several public repositories, and scanning for MPTCP on port 443 was reported in early November 2026.
The underlying bug is not specific to MPTCP. MPTCP is only the condition the demonstrated exploit relies on, so a server without MPTCP still needs the patch.
Which kernel versions are fixed?
The fix landed in these upstream releases in October 2026:
| Kernel branch | First fixed version |
|---|---|
| Mainline | 7.3 |
| 7.2 | 7.2.10 |
| 6.18 | 6.18.56 |
| 6.12 | 6.12.113 |
| 6.6 | 6.6.159 |
| 6.1 | 6.1.190 |
| 5.15 | 5.15.223 |
| 5.10 | 5.10.272 |
Branches older than 5.10 get no upstream fix. Most servers do not run an upstream kernel anyway. Distributions apply the fix to their own kernel packages, so a fixed Ubuntu or AlmaLinux kernel can have a version number that does not appear in this table.
Distribution status as of 5 November 2026:
- Fixed: RHEL 8, 9 and 10, AlmaLinux, Debian and Ubuntu 26.10.
- In testing at that date: Ubuntu 22.04, 24.04 and 26.04. Partial fixes on SUSE.
- No fix announced: Ubuntu 16.04 to 20.04 outside extended support.
Status changes daily, so check your distribution’s security tracker for CVE-2026-98432 before deciding a server is safe.
How do I patch CVE-2026-98432?
1. Install the updated kernel
# Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
# AlmaLinux / Rocky Linux / RHEL
sudo dnf upgrade kernel2. Reboot into it
A new kernel package does nothing until the machine boots into it:
sudo reboot
uname -r # after the reboot: confirm the new version is runningOn RHEL-family systems, sudo dnf needs-restarting -r tells you whether a reboot is pending. On Debian and Ubuntu, the file /var/run/reboot-required exists when one is needed.
If downtime is hard to schedule, a live-patching service can apply the fix to the running kernel, as long as it covers this CVE. Plan a normal reboot later anyway.
3. Check MPTCP listeners
ss -MlnpThis lists services listening with Multipath TCP. An empty list lowers the immediate risk but is not a reason to skip the update. Note that programs built with Go 1.24 or newer open MPTCP listeners by default on Linux, so a Go service can expose MPTCP without anyone choosing to.
Temporary mitigations until you can reboot
These steps reduce exposure. They do not fix the bug, and some of them are lost at the next reboot.
- Disable MPTCP:
sudo sysctl -w net.mptcp.enabled=0 echo 'net.mptcp.enabled = 0' | sudo tee /etc/sysctl.d/90-no-mptcp.confFor Go programs you can also set
GODEBUG=multipathtcp=0in the service environment. - Drop IPv4 packets that carry IP options. Normal traffic almost never uses them. With nftables:
sudo nft add table inet guard sudo nft add chain inet guard input '{ type filter hook input priority -300; }' sudo nft add rule inet guard input ip hdrlength != 5 dropThis filter has been reported as helpful but not complete.
- Limit exposure. Close ports that do not need to be public and put admin services behind a firewall or VPN.
The boot option init_on_free=1 does not protect against this bug.
VPS, dedicated servers and containers
Who has to apply the patch depends on how your server is built:
- KVM VPS: the virtual server runs its own kernel. Updating the physical host does not change the kernel inside your VPS. You install the kernel update and reboot from inside the VPS.
- Dedicated server: same as above, you update and reboot the machine.
- Containers (Docker, LXC): containers share the kernel of the machine they run on. Rebuilding an image does nothing for this bug. The host has to be patched and rebooted.
All our VPS plans run on KVM, so you control the kernel and the reboot window. If you have not set up automatic security updates yet, our Linux VPS security checklist shows how, including how to tell when a reboot is waiting.
