What is CVE-2026-98432?

CVE-2026-98432 is a race condition in the code that sets up new IPv4 TCP connections. When a server is finishing a TCP handshake, one CPU core can hand a piece of memory to the new connection while another core is still reading it to answer a retransmitted SYN packet. The kernel can then use memory that has already been freed.

In practice, this kind of bug can lead to three outcomes:

• a kernel crash (denial of service);
• a leak of kernel memory;
• full remote code execution as root, in the worst case.

The Linux kernel CVE team rated it 9.8 out of 10 (Critical). Red Hat first scored it lower as a hard-to-exploit denial-of-service issue, then raised its rating to Critical 9.8 after a public demonstration showed remote root was realistic.

Why this vulnerability is getting so much attention

Three things make CVE-2026-98432 different from the usual monthly kernel update:

1. No login needed. The attack runs over the network against any open TCP port, such as SSH (22) or HTTPS (443).
2. A proven exploit exists. Anthropic’s researchers reported that an AI model built a working exploit that bypassed kernel address randomisation (KASLR) and reached root in about 53 minutes.
3. Attackers are already looking. Independent researchers have reported internet-wide scanning for exposed, unpatched systems since 1–3 November 2026.

The bug has been in the kernel since version 4.4, released in 2016. That means almost every Linux server in production today runs an affected kernel unless it has been patched in the last few days.

Is my server affected by CVE-2026-98432?

Your server is likely affected if all of these are true:

• it runs Linux kernel 4.4 or newer;
• it has not installed a kernel update released after 30 October 2026;
• it accepts inbound TCP connections from untrusted networks.

The publicly demonstrated exploit used a listener with Multipath TCP (MPTCP) enabled. MPTCP is turned on by default by some software, including many Go-based web servers. However, the underlying bug sits in ordinary IPv4 TCP code, so disabling MPTCP alone does not make a server safe. Treat it as a temporary risk reduction, not a fix.

Start by checking the kernel you are actually running:

uname -r
cat /etc/os-release | grep PRETTY_NAME

Then compare that version with the fixed versions in the table below.

CVE-2026-98432 patch status by distribution (as of 3 November 2026)

Distribution	Status	Fixed kernel version
Debian 13 (trixie)	Fixed (DSA-6568-1)	linux 6.12.113-1 or later
Debian 12 (bookworm)	Fixed (DLA-4841-1, DLA-4850-1)	linux 6.1.190-1; linux-6.12 6.12.113-1~deb12u1
RHEL 10	Fixed 1 Nov 2026 (RHSA-2026:93413)	kernel-6.12.0-211.72.1.el10_2
RHEL 9	Fixed 1 Nov 2026 (RHSA-2026:93412)	kernel-5.14.0-687.64.1.el9_8
RHEL 8	Fixed 1 Nov 2026 (RHSA-2026:93414)	kernel-4.18.0-553.182.1.el8_10
Ubuntu 22.04 / 24.04 / 26.04	Fix in testing (-proposed)	5.15.0-203.213 / 6.8.0-149.149 / 7.0.0-43.43
Oracle Linux (UEK)	Fixed	See Oracle ELSA advisories
Amazon Linux 2 / 2023	Fixed	See ALAS advisories

Always confirm against the official trackers before you patch, because these entries change several times a day: Debian Security Tracker, Ubuntu CVE page and Red Hat CVE record.

How to patch CVE-2026-98432

Debian 12 and Debian 13

apt update
apt full-upgrade
apt-cache policy linux-image-amd64
reboot

After the reboot, run uname -r again. Compare it with the version from the security suite, not the base release. If the version did not change, check that security.debian.org is in your APT sources.

RHEL, Rocky Linux and AlmaLinux

dnf clean all
dnf update kernel
reboot
rpm -q kernel
uname -r

The running kernel must match one of the fixed builds listed above, or a newer one. On Rocky Linux and AlmaLinux, wait for your vendor’s rebuild and then run the same commands.

Ubuntu 22.04, 24.04 and 26.04

Canonical’s fixed kernels are still in the -proposed pocket, which means they are under test. You have two options:

• Production servers: apply the temporary hardening steps below now, and install the official update the moment it reaches -security. Run apt update && apt list --upgradable | grep linux-image daily.
• Exposed, high-risk servers: consider installing the -proposed kernel after testing it on a staging machine first. Plan a maintenance window and keep console access, in case the new kernel does not boot.

If you use Canonical Livepatch, check its status with canonical-livepatch status. A live patch can close the hole without an immediate reboot once Canonical publishes it.

Proxmox VE hosts and virtual machines

Remember that a hypervisor and every guest VM run separate kernels. Patch the Proxmox host from its own repositories, then patch each Linux VM and container host inside your cluster. Migrate VMs between nodes so you can reboot each node without downtime.

Temporary hardening until you can reboot

These steps reduce exposure. They do not replace the kernel update.

• Close what you do not need. Run ss -tlnp and list every listening TCP port. Anything that does not have to be public should be firewalled to trusted IPs.
• Restrict SSH. Allow port 22 only from your office, VPN or bastion host.
• Disable MPTCP where unused. sysctl -w net.mptcp.enabled=0 blocks the demonstrated attack path, but not the underlying bug.
• Put a filter in front. A firewall, WAF or DDoS-filtering layer cuts the number of hosts that can reach your services directly.
• Watch for crashes. Unexpected kernel panics or reboots can be a sign of exploitation attempts. Check journalctl -k -b -1 after any unplanned restart.

How to confirm you are protected from CVE-2026-98432

A server is only patched when it runs the fixed kernel. Installing the package is not enough. Many breaches happen on machines where the update was installed months ago, but nobody rebooted.

uname -r
needs-restarting -r   # RHEL family
ls /var/run/reboot-required 2>/dev/null   # Debian/Ubuntu

Record the date and kernel version for every server you patch. If you manage many machines, a monitoring system such as Zabbix can alert you when a host is still running an old kernel.

What this means for businesses

This flaw is a reminder that a server is never “set and forget”. The fix existed upstream for days before every distribution shipped it, and attackers moved quickly in that gap. Businesses without someone watching security advisories every day are the ones most likely to be caught.

At RootHosts, kernel updates and hardening are part of our Linux server support and managed security protection services. If you are not sure whether your servers are patched, contact our team. We will check your kernels, apply the update, reboot safely and confirm the result, with the price agreed before we start.

Conclusion: act on CVE-2026-98432 now

CVE-2026-98432 is one of the most serious Linux kernel bugs in years: remote, unauthenticated, rated 9.8, and with a working exploit. Debian, RHEL and most major distributions already have fixes; Ubuntu users should harden now and patch as soon as the update lands. Check uname -r on every internet-facing server today, update, reboot and verify.

Frequently Asked Questions

What is CVE-2026-98432?

It is a critical use-after-free bug in the Linux kernel’s IPv4 TCP handshake code, rated CVSS 9.8. It can let a remote attacker crash the server or run code as root.

Which Linux versions are affected?

All kernels from version 4.4 onward that have not received the November 2026 security update, including Ubuntu, Debian, RHEL, Rocky Linux and AlmaLinux.

Is disabling MPTCP enough to stay safe?

No. The public exploit used MPTCP, but the bug is in normal IPv4 TCP code. Disabling MPTCP only reduces risk until you install the fixed kernel.

Do I need to reboot after updating?

Yes. The fix only works when the server runs the new kernel, which requires a reboot or a live patch from your vendor.

How do I check my kernel version?

Run uname -r and compare the result with the fixed version listed for your distribution in its official security tracker.