Skip to content
All posts

· by NetProtector Security Team

CVE-2026-98432: Critical Vulnerability in the Linux Kernel TCP Stack

Illustration: network packets flowing into a kernel chip, with a crafted packet causing a crack

A vulnerability in the Linux kernel's TCP stack can be triggered over the network without authentication and, in the worst case, can lead to root privileges. The bug has been in the code since Linux 4.4 – in other words, for almost ten years. Patches are available but have not yet reached all distributions.

What is CVE-2026-98432?

It is a use-after-free bug in the handling of IPv4 TCP connections, rated CVSS 3.1 9.8 (critical). During connection setup, the kernel passes IPv4 options from the connection request to the new socket. Since Linux 4.4, these steps run without locking the listening socket. If a retransmitted SYN packet arrives on a different CPU core while the new socket is being freed, the kernel reads memory that has already been freed.

An attack requires:

  • network access to an IPv4 TCP service on an unpatched system,
  • a connection packet with IPv4 options (e.g. Record Route or Timestamp) and its retransmission,
  • no credentials and no user interaction.

Losing the race only causes the connection setup to fail – so an attacker can try as often as they like.

How dangerous is this in practice?

A researcher at Anthropic reported the bug. On 27 October 2026, Anthropic reported an exploit that gains root privileges on servers with a Multipath TCP (MPTCP) listener; it has not been published. As of early November, no working public exploit was known, and the vulnerability was not listed in the KEV catalog of the US agency CISA. That can change quickly.

Important: The Go security team points out that Go enables MPTCP on Linux listeners by default as of version 1.24. Go services may therefore meet the precondition for the known exploit without anyone having deliberately enabled it.

Affected and fixed versions

All kernels from 4.4 onward without the fix are affected. The bug is fixed in Linux 7.3 and in the stable versions 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10. Debian, SUSE, Oracle Linux and Amazon Linux have already shipped fixed kernels for some of their releases, and Red Hat rates the vulnerability as critical; at the end of October, updates for RHEL and Ubuntu were still pending, and according to reports, the RHEL updates followed in early November. For the current status, refer to your distribution's advisory.

What you should do now

  1. Update the kernel and reboot – a kernel that is installed but not booted offers no protection. Use uname -r to check what is actually running.

  2. Reduce the attack surface until you can update:

    sysctl -w net.mptcp.enabled=0
sysctl -w net.ipv4.tcp_migrate_req=0

    To make this persistent, use a file in /etc/sysctl.d/. This lowers the likelihood but does not completely prevent exploitation.

  3. Find MPTCP listeners: ss -M -l -n -p shows services offering Multipath TCP – check Go applications in particular.

  4. Filter IPv4 options where possible: dropping packets with IP options at the perimeter provides additional protection for exposed services. Test beforehand whether any applications depend on them.

Our assessment

Kernel vulnerabilities that can be exploited over the network are rare but particularly troublesome: they affect every service, not just one application, and also appliances, routers or container hosts that run Linux at their core. In addition to prompt patching, it helps to have a network architecture that only exposes the services that genuinely need to be reachable – and an intrusion prevention system that can detect and block unusual packets such as TCP connections with IP options.

Sources