Linux TCP flaw CVE-2026-98432: Ubuntu and RHEL still unpatched
A critical kernel bug reachable on any listening IPv4 port is fixed on Debian and Amazon Linux, not yet on Ubuntu or Red Hat. A firewall rule buys time.
The short read
A Linux kernel bug rated 9.8 of 10 can be reached through any listening IPv4 TCP port, with no login.
- On October 31, Debian and Amazon Linux had fixed kernels; Ubuntu had builds in progress and Red Hat had none.
What you can do with this
Run uname -r on every Linux server and compare it with the fixed versions below. Where no fix exists, add the nftables rule Red Hat publishes, then patch and reboot when your distro ships.
A use-after-free bug in the Linux kernel’s IPv4 TCP code, CVE-2026-98432, was announced by the kernel CVE team and is rated 9.8 of 10: it can be triggered over the network with no login or user action. If your company runs Linux servers that accept connections from the internet, the fix depends on your distribution, and two of the biggest have not shipped one.
On October 27 Anthropic wrote that an internal Claude model wrote a working exploit that runs commands as root on some servers. We checked five distribution trackers and CISA’s list at about 14:40 UTC on October 31. TuxCare’s table from October 30 listed Amazon Linux 2 and the default Amazon Linux 2023 kernel as pending; Amazon’s tracker now shows fixes for both, dated October 30.
A connection request with IPv4 options reaches the bug
The trigger is a connection request (a SYN packet) that carries IPv4 options, sent to a listening IPv4 TCP port. AlmaLinux explains the mechanism: the kernel hands those options to the new connection without copying them. If the client retransmits its SYN, another CPU can still be building a reply from them while the connection closes and the memory is freed. The code runs “before any application sees the connection,” so no setting inside the application can block it.
The bug dates to Linux 4.4. IPv6 is not affected by the main issue, per the fix description quoted in Debian’s tracker.
The exploit needs time and multipath TCP
Anthropic’s exploit targets servers with a multipath TCP (MPTCP) listener. It first leaks a kernel pointer, which took 48 minutes in its proof of concept, then needs “another five minutes” to run commands as root. A lost race “only fails the handshake,” so an attacker can keep retrying without crashing the machine.
That narrows the proven attack, but not the bug. AlmaLinux ships with MPTCP off, yet says systems without it “still need the fix,” because the flaw sits in ordinary TCP code. CISA had not added the CVE to its known exploited list when we checked, and Anthropic’s post does not say whether it will publish the exploit.
Patch status on October 31
| Distribution | Status | Fixed kernel |
|---|---|---|
| Upstream stable | Fixed | 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 |
| Debian 12 and 13 | Fixed | 6.1.190-1, 6.12.113-1 (tracker) |
| Amazon Linux 2 and 2023 | Fixed October 24 to 30 | ALAS2-2026-4065, ALAS2023-2026-3365 and others (tracker) |
| AlmaLinux 8, 9, 10 | Testing repo only | 4.18.0-553.180.2, 5.14.0-687.61.2, 6.12.0-211.69.2 (post) |
| Ubuntu 22.04, 24.04, 26.04 | Pending | 5.15.0-203.213, 6.8.0-149.149, 7.0.0-43.43 in progress (tracker) |
| Ubuntu 20.04 | Vulnerable | No build listed |
| RHEL 8, 9, 10 | No fix | Red Hat is “expediting” (bulletin) |
Ubuntu’s cloud kernels (linux-aws, linux-azure, linux-gcp) are also pending for 22.04 and later. Red Hat says OpenShift is affected too. Hosts are waiting on the same vendors: Akamai’s Linode status page tells customers to apply OS updates “once they become available” and reports no sign of exploitation on its platform.
What to do now
- Find your kernel. Run
uname -ron each server and compare it with the table. A managed host or platform handles its own kernels; ask it for a date. - Patch where you can. On Debian or Amazon Linux, install the fixed kernel package and reboot. A kernel fix does nothing until the reboot.
- Filter where you cannot. Red Hat’s bulletin gives an nftables rule that drops incoming IPv4 TCP packets with options (
ip protocol tcp ip hdrlength > 5 counter drop), with commands to check, apply and later remove it. Normal traffic almost never uses those options, per AlmaLinux. The trade-offs, per AlmaLinux: the rule does not survive a reboot, traffic between containers on the same host may bypass it, and networks that rely on CIPSO security labels should not use it. Red Hat says to test it first. - Check MPTCP.
sysctl net.mptcp.enabledshould print 0 on hosts that do not need it, andnet.ipv4.tcp_migrate_reqshould be 0, per TuxCare. Turning MPTCP off only stops new MPTCP sockets; AlmaLinux lists open listeners withsudo ss -lnMpand says to restart the services that own them. - Be careful with AlmaLinux testing kernels. They are pre-release; AlmaLinux asks you to disable the testing repo after the update on production machines.
“Neither step is a fix,” AlmaLinux writes. Both buy time until Ubuntu and Red Hat ship.
Sources
- Linux kernel CVE team: CVE-2026-98432 announcement
- Anthropic: Discovering and exploiting vulnerabilities in critical, real-world software with Claude (October 27, 2026)
- AlmaLinux: CVE-2026-98432, patched kernels available in testing (October 30, 2026)
- Red Hat CVE page: CVE-2026-98432
- Red Hat security bulletin RHSB-2026-016
- Ubuntu CVE tracker: CVE-2026-98432
- Debian security tracker: CVE-2026-98432
- Amazon Linux security center: CVE-2026-98432
- TuxCare: CVE-2026-98432 and which distros are patched (October 30, 2026)
- Akamai Linode status: CVE-2026-98432 advisory
- CISA known exploited vulnerabilities catalog
