Security Guides

#vulnerability #CVE-2026-98432 #Linux #kernel #TCP #MPTCP #server #AI-era readiness

Linux kernel CVE-2026-98432: a network-triggered TCP use-after-free (CVSS 9.8); install the fixed kernel, reboot, and check MPTCP

CVE-2026-98432 is a Linux kernel IPv4 TCP use-after-free rated CVSS 9.8. Fixed kernel versions, Debian, Ubuntu, Red Hat and SUSE status, and what to do today.

Published 2026-11-01 Updated 2026-11-01 Last verified 2026-11-01 11 min read

On this page

For: people who run Linux servers, especially internet-facing ones, and teams that build network services in Go. This article is based on the CVE record in NVD, the Debian, Ubuntu, Red Hat and SUSE pages, the Go project's security announcement and BleepingComputer's report. It does not cover attack steps or exploit code.

Install your distribution's fixed kernel and reboot, starting with internet-facing servers

A flaw in the kernel's TCP code can be reached over the network, and the kernel project rates it 9.8. Researchers at an AI company reportedly demonstrated remote code execution in a lab (the company's own report, not verified by the press), and AI-assisted exploit development can shorten the gap between a fix and a working attack.

Debian 12 and 13 already have fixed kernels; check SUSE; Ubuntu and Red Hat list fixes as in progress on November 1
After installing, reboot (or use your vendor's live patch if it covers this) and confirm with uname -r
Until then, use a vendor stop-gap, and keep services on trusted networks where you can
Turning MPTCP off is worth doing, but it does not replace the kernel update

Developing: this page will be updated as more is published

Who is affected: people who run Linux servers, especially internet-facing ones, and teams that build network services in Go.
Confirmed so farSee the table ↓: The flaw
Upstream fixed versions
Debian fixed kernels
Not yet confirmed: Fixed kernels from Ubuntu and Red Hat
Whether remote code execution works against servers without MPTCP
Any exploitation in the wild
1 more
NVD's own assessment (status: Received)
What to do nowSee the steps ↓: List the Linux servers that accept IPv4 TCP connections from outside
Install the fixed kernel where one exists
Reboot, then confirm the running kernel
2 more
If no fix is available yet, apply a vendor stop-gap and narrow exposure
Find services that listen with MPTCP, including Go programs
Where to verify (source)All sources ↓: NVD, "CVE-2026-98432"
Last checked: As of November 1, 2026 (JST)

Follow-up plans and what we checked

Red Hat's bulletin is marked "Ongoing" and says fixes are being expedited. Ubuntu lists fixes as in progress. Debian has shipped fixed kernels.

What to do today

List the Linux servers that accept IPv4 TCP connections from outside

Almost every internet-facing Linux host qualifies, including container hosts and virtual machines. The CVE rates the attack as needing no account and no user action (CVSS v3.1 9.8), so start with servers reachable from the internet (this site's view).

Install the fixed kernel where one exists

On Debian, bookworm needs 6.1.190-1 and trixie needs 6.12.113-1 from the security archive. For SUSE, check your product on SUSE's page, because some streams are released and some are in progress. For Ubuntu and Red Hat, watch the pages in the sources; they listed no fixed kernel on November 1.

Reboot, then confirm the running kernel

Run uname -r after the reboot. An installed package that is not the running kernel does not protect you. A vendor live patch that covers this CVE would also count, but check the vendor page first, because SUSE lists live patching as in progress for most streams.

If no fix is available yet, apply a vendor stop-gap and narrow exposure

Red Hat describes a filter that drops incoming IPv4 TCP packets with IP options and says it can reduce exposure but cannot replace patching. Test it first, and remove it after the kernel is fixed. Where you can, restrict who can reach a service to trusted networks, which is a mitigation BleepingComputer lists.

Find services that listen with MPTCP, including Go programs

The Go project's security team says Go 1.24 and later enable MPTCP by default on Linux listen sockets, so a Go service may use MPTCP without anyone choosing it. The team describes turning it off per program as a fragile way to reduce exposure, and says the best fix is a patched kernel. Do this as an extra, not a substitute.

Fixed kernel available

Debian 12 and 13, some SUSE products. Install, reboot, run uname -r

Fix in progress

Ubuntu, RHEL and related products. Use the vendor stop-gap and narrow exposure

Also check

MPTCP listeners, including Go 1.24 or later services

How far the fix has reached on November 1, 2026. Check the row for your own distribution.

Fixed versions

9.8

CVSS v3.1 (Linux kernel CNA, shown in NVD; Ubuntu agrees)

Network

Attack vector: remote, no privileges, no user interaction

Oct 15

CVE published (NVD)

Not in KEV

CISA catalog, checked Nov 1

Kernel line	Not affected from	Source
5.10	5.10.272	CVE record in NVD (kernel CNA)
5.15	5.15.223	Same
6.1	6.1.190	Same
6.6	6.6.159	Same
6.12	6.12.113	Same
6.18	6.18.56	Same
7.2	7.2.10	Same
7.3 and later	Fixed by the original fix commit (Debian: upstream 7.3-rc7)	NVD, Debian

The affected range reaches back to kernel 4.4 according to NVD. Each branch has its own fixed version, so judge by your distributor's package version rather than the upstream number.

Distribution	Status on November 1, 2026
Debian 12 (bookworm)	Fixed: 6.1.190-1 (security)
Debian 13 (trixie)	Fixed: 6.12.113-1 (security)
Debian testing and unstable	Fixed: 7.2.12-1 and 7.2.14-1
Ubuntu 26.10, 26.04 LTS, 24.04 LTS, 22.04 LTS	Vulnerable, fix in progress
Ubuntu 20.04, 18.04, 16.04	Vulnerable, no version listed
Ubuntu 14.04	Not affected
RHEL 8, 9, 10; OpenShift	Affected; no fix listed on Red Hat's pages. Bulletin status "Ongoing"
SUSE Linux Enterprise Server 16.0, 15 SP4 to SP6 LTSS, Micro 5.4, 5.5, 6.2	Fixes released
SUSE Linux Enterprise Server 15 SP7, most live patching streams	In progress
SUSE Linux Enterprise Server 12 SP5, Micro 6.0 and 6.1	Affected

SUSE says its own page may be incomplete or out of date. Red Hat also lists products built on the RHEL kernel (such as RHEL CoreOS, OpenStack Platform and Virtualization) as potentially impacted. Cloud, appliance and other vendor kernels follow their own schedules.

What was disclosed

Use-after-free of IP options in IPv4 TCP (CVE-2026-98432)

CVE: CVE-2026-98432, published October 15, 2026. NVD status Received, last modified October 31
Type: Use-after-free (the CVE record does not give a CWE)
Severity: CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N) from the kernel CNA. Ubuntu: High, 9.8. Red Hat: Critical (preliminary 9.8 on its CVE page). SUSE: important, 8.1 (it rates attack complexity High)
Where: IPv4 TCP in the kernel. The IP options structures (inet_opt and ireq_opt) were freed without waiting for readers, which leads to a use-after-free in ip_options_build(). A related case in request-socket migration is also fixed
Trigger: Per Debian's tracker, a retransmitted SYN racing with creation of the child socket can read the options after they are freed. IPv6 is not affected by the main issue
Fix: Free these structures after an RCU grace period (kfree_rcu()). Eight stable-branch commits are referenced in NVD
Exploitation: No confirmed in-the-wild exploitation in the sources checked. Not in CISA KEV on November 1

In plain words, the kernel released a small piece of memory that held connection options while another part could still be reading it. Memory that is read after it is freed can be reused for something else, and that kind of flaw can end in a crash or in code running with kernel privileges.

Red Hat describes the main impact as a system crash leading to a Denial of Service (DoS) or potential memory corruption. Its CVE page explains the Critical rating this way: an unauthenticated remote attacker can cause kernel memory corruption or an immediate crash over standard IPv4 TCP traffic, and reliable code execution needs precise control of memory. BleepingComputer reported that Red Hat scored the flaw 5.9 as a possible denial of service. The Red Hat pages this site checked on November 1 show Critical and a preliminary 9.8 instead. Ratings differ between sources and may have changed, so check the page for your product.

The MPTCP demonstration and the AI angle

BleepingComputer reported on October 30 that researchers at an AI company reportedly demonstrated remote code execution as root in a lab, according to the company's own report that BleepingComputer cites but did not verify, against a Linux server with an MPTCP listener, using an exploit developed by an unreleased AI model of that company. The Go project's security team made a similar statement in an announcement relayed on the oss-security list on October 29: a server with MPTCP listeners was shown to be vulnerable to remote code execution, and the bug is not specific to MPTCP. This site did not review the demonstration itself and does not link to it.

What is and is not shown, according to BleepingComputer:

The demonstrated code execution needed an MPTCP listener
Remote code execution on servers without an MPTCP listener has not been demonstrated publicly
No in-the-wild exploitation was confirmed as of the report

MPTCP is optional in the kernel, but the Go project's security team says Go 1.24 and later turn it on by default for listen sockets on Linux. That is why teams running Go network services should check their own listeners.

The lesson for defenders is speed. If an AI model can turn a published kernel fix into a working exploit, the gap between a patch becoming public and an attack becoming possible may be shorter than it used to be (this site's view). That is a reason to update on the vendor's first fixed kernel rather than the next maintenance window.

What is known and not known

Item	What was published	Status
The flaw	Use-after-free of IP options in IPv4 TCP; CVSS 9.8 from the kernel CNA, Ubuntu High 9.8, Red Hat Critical (preliminary), SUSE 8.1	Confirmed (kernel CNA, NVD, vendors)
Upstream fixed versions	5.10.272 up to 7.2.10, listed above	Confirmed (CVE record in NVD)
Debian fixed kernels	6.1.190-1 and 6.12.113-1	Confirmed (Debian tracker)
Ubuntu and Red Hat fixed kernels	Not listed on the pages checked	In progress (vendors)
Remote code execution with an MPTCP listener	Reported as shown in a lab by researchers at an AI company	Reported (BleepingComputer, Go project's security team)
Remote code execution without MPTCP	Not shown publicly; the Go project's security team warns similar attacks may be possible	Not yet known
Exploitation in the wild	None confirmed; not in CISA KEV on November 1	Not yet known
NVD's own score	None assigned yet (status Received)	Not yet known

Sources

Checked on November 1, 2026.

NVD, "CVE-2026-98432" — nvd.nist.gov
Debian security tracker — security-tracker.debian.org
Ubuntu — ubuntu.com
Red Hat, bulletin RHSB-2026-016 — access.redhat.com / CVE page — access.redhat.com
SUSE — suse.com
Go project's security announcement, relayed on oss-security (October 29, 2026) — openwall.com
BleepingComputer, "Critical Linux kernel flaw allows remote root attacks on MPTCP servers" (October 30, 2026) — bleepingcomputer.com
CISA Known Exploited Vulnerabilities Catalog (checked for this CVE on November 1) — cisa.gov

Update history

2026-11-01: First version, based on NVD, Debian, Ubuntu, Red Hat and SUSE pages, the Go project's security announcement and BleepingComputer's report as of November 1.

Latest breaking reports

All breaking reports →

FAQ

QWhat is CVE-2026-98432?

A use-after-free in the Linux kernel's IPv4 TCP code. The kernel freed the IP options attached to a connection request with a plain free while another part of the kernel could still read them, for example when a retransmitted SYN arrives while the child socket is being created. The kernel project's CNA rates it CVSS v3.1 9.8 (network attack, no privileges, no user interaction). IPv6 is not affected by the main issue, according to the CVE description.

QIs a server without MPTCP safe?

Not on that basis. The remote-code-execution demonstration reported by BleepingComputer (from the company's own report, which the outlet did not verify) used an MPTCP listener, but the Go project's security team says the bug is not specific to MPTCP and systems without MPTCP listeners may be open to similar attacks. Remote code execution on plain TCP servers has not been shown publicly, according to BleepingComputer, so treat the risk as real but unproven in that case.

QIs it being exploited in the wild?

No confirmed exploitation was reported in the sources checked. BleepingComputer reported none as of October 30, and the CVE was not in CISA's Known Exploited Vulnerabilities catalog when this site checked on November 1. A lab demonstration by researchers at an AI company has been reported, so the time to a working exploit may be short.

QWhich kernel versions are fixed?

The CVE record lists 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10 and later as not affected. Distributions backport fixes, so go by the package version: Debian 12 (bookworm) 6.1.190-1 and Debian 13 (trixie) 6.12.113-1 are fixed. Ubuntu and Red Hat had not published fixed kernels in the pages this site checked on November 1.

QCan I just turn MPTCP off?

It reduces exposure but is not a fix. BleepingComputer reports that disabling MPTCP alone is insufficient because ordinary TCP traffic can still reach the flaw, and the Go project's security team calls per-program disabling fragile. Install the fixed kernel and reboot.

QWhat is Red Hat's mitigation?

Red Hat's bulletin RHSB-2026-016 describes a packet filter that drops incoming IPv4 TCP packets carrying IP options. Red Hat says filtering can reduce exposure but is not a substitute for patching, and that it should be tested first and removed after the kernel is fixed.