2026-11-01
Linux kernel CVE-2026-98432: a network-triggered TCP use-after-free (CVSS 9.8); install the fixed kernel, reboot, and check MPTCP
CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP code, published on October 15, 2026. The kernel project's CNA scores it CVSS v3.1 9.8 (network, no privileges, no user interaction). Researchers at an AI company reportedly demonstrated, in a lab and by their own report, remote code execution as root against a server with a Multipath TCP (MPTCP) listener. BleepingComputer says remote code execution on plain TCP servers has not been shown publicly and no exploitation in the wild has been confirmed, and this site did not find the CVE in CISA's KEV catalog on November 1. Upstream fixes are in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10 and later. As of November 1, Debian has fixed kernels, SUSE has some, and Ubuntu and Red Hat list fixes as in progress. Disabling MPTCP alone is not a full fix. This site's conclusion: update internet-facing Linux servers as fixes land, reboot, and use a vendor stop-gap only until then.