Insights
Critical Linux Kernel TCP Vulnerability (CVE-2026-98432): Mitigated at the QUAPE Edge, Patch Your Own Servers
On 15 October 2026 the Linux kernel CVE team published CVE-2026-98432, a critical flaw in the kernel's IPv4 TCP connection handling that has been present in every Linux kernel since version 4.4, released in January 2016. It is rated 9.8 (Critical) on CVSS v3.1. An attacker needs no account, no password and no interaction from anyone: a crafted TCP connection attempt to any open IPv4 port is enough to trigger it. In the worst case it leads to remote code execution as root.
QUAPE has already mitigated this vulnerability at our edge for all hosting customers. This article explains what the bug is and what customers who manage their own servers must do now.
The short version
Every Linux server that accepts IPv4 TCP connections from the internet is affected unless its kernel has been patched. The only complete fix is a kernel update and a reboot (or a live patch from your vendor). QUAPE has mitigated it at our edge, so shared, WordPress and managed hosting customers are protected and need to do nothing. VPS, dedicated and colocation customers must patch their own kernels and may apply the interim firewall rule below in the meantime.
What is CVE-2026-98432?
When a client opens a TCP connection, it sends a SYN packet. That packet may carry optional IPv4 header fields such as Record Route or Timestamp. The kernel keeps a copy of those options with the pending connection so it can echo them back in its reply, and when the handshake completes it hands that copy to the new socket without duplicating it.
The problem is a race condition. If the client retransmits its SYN while the new connection is already being torn down, a second CPU can still be building a reply from the same options at the moment the first CPU frees them. The reply code then reads memory that has already been released, a classic use-after-free. Losing the race simply fails that one handshake without crashing anything, so an attacker can keep trying until they win.
The outcome ranges from a kernel crash (denial of service) to memory corruption that can be turned into code execution. On 27 October 2026, Anthropic reported that an unreleased internal research model had turned this bug into a working, zero-click remote root exploit against Linux servers running a multipath TCP (MPTCP) listener, leaking a kernel address to defeat KASLR in about 48 minutes and reaching command execution as root about five minutes later. The exploit code has not been published.
Two points are easy to get wrong:
- MPTCP is not required. The demonstrated exploit used an MPTCP listener, but the vulnerable code is in ordinary IPv4 TCP handling. Red Hat states that a default system with MPTCP disabled remains affected, so turning MPTCP off is not a fix. Note that Go 1.24 and newer enable MPTCP on Linux listeners by default, so some services expose MPTCP without their operators knowing.
- IPv6 is not affected by the main issue, because the IPv6 path copies the options. A secondary variant involves TCP request socket migration (
net.ipv4.tcp_migrate_req), which is off by default.
As of early November 2026 no vendor or CERT has reported exploitation in the wild and the CVE is not in CISA's Known Exploited Vulnerabilities catalogue. Given the severity and the public attention, we do not expect that to last.
Which kernels are affected and which are fixed?
The upstream fix by Eric Dumazet landed on 5 October 2026 and has been backported to every maintained stable branch. Kernels from the 4.4 to 5.4 series are end of life and will not receive it.
| Kernel branch | First fixed release |
|---|---|
| 7.3 | 7.3 |
| 7.2 | 7.2.10 |
| 6.18 | 6.18.56 |
| 6.12 | 6.12.113 |
| 6.6 | 6.6.159 |
| 6.1 | 6.1.190 |
| 5.15 | 5.15.223 |
| 5.10 | 5.10.272 |
| 4.4 to 5.4 | End of life, no fix |
Distributions backport the fix into their own kernel builds, so compare against your vendor's advisory rather than the numbers above. Status at the time of writing:
| Distribution | Status |
|---|---|
| Debian 12 | Fixed: linux 6.1.190-1 (DLA-4841-1), linux-6.12 6.12.113-1~deb12u1 |
| Debian 13 | Fixed: 6.12.113-1 (DSA-6568-1) |
| Ubuntu 26.10 | Fixed: 7.3.0-10.10 |
| Ubuntu 22.04 / 24.04 / 26.04 LTS | Fixes in the -proposed pocket (5.15.0-203.213, 6.8.0-149.149, 7.0.0-43.43); check the Ubuntu tracker for release to -updates |
| Ubuntu 20.04 and older | Vulnerable, fix in progress |
| RHEL, AlmaLinux, Rocky Linux, Oracle RHCK 8 / 9 / 10 | Fixed: 4.18.0-553.182.1.el8_10, 5.14.0-687.64.1.el9_8, 6.12.0-211.72.1.el10_2 |
| RHEL / CentOS 7 | Not affected |
| Oracle Linux UEK | Fixed 16 October 2026 |
| Amazon Linux 2 and 2023 | Fixed in late October 2026 |
| SUSE / openSUSE | Fixed for most streams; live patches available for selected kernels |
What QUAPE has done
We have mitigated CVE-2026-98432 at the QUAPE edge for all shared, WordPress and managed hosting servers, as well as the QUAPE website, customer portal and nameservers. No action is required from customers on these services. Platform kernel updates are being applied under our regular maintenance programme.
What you need to do
Shared, WordPress and managed hosting customers
Nothing. The vulnerability is mitigated for your service and the kernel on your server is maintained by us.
VPS, dedicated server and colocation customers
You manage the operating system on these services, so you must patch the kernel yourself, and you should do it this week:
- Check your running kernel with
uname -rand compare it with your distribution's advisory for CVE-2026-98432. - Install the fixed kernel (
apt update && apt upgradeon Debian and Ubuntu,dnf upgradeon RHEL-family systems) and reboot. A kernel update does nothing until the server restarts, unless you use a live-patching service such as KernelCare or SUSE Live Patch. - If your distribution has not released the fix yet, apply the interim firewall rule below and restrict exposed TCP ports to trusted sources until it has.
- Optionally, confirm you have no unexpected MPTCP listeners with
ss -Mlnp. An empty result does not mean you are safe, because MPTCP is not required for the bug.
If you would like QUAPE to patch a server for you, open a support ticket from your account and our engineers will schedule it.
Interim measure: drop IPv4 TCP packets with IP options
Red Hat, Ubuntu and the AlmaLinux project document the same stopgap for servers you manage yourself. It drops every inbound IPv4 TCP packet whose header is longer than the standard 20 bytes, which is the signature of IP options:
cat > /etc/nftables.d/cve-2026-98432.nft <<'EOF'
table inet cve_2026_98432 {
chain input {
type filter hook input priority -310; policy accept;
ip protocol tcp ip hdrlength > 5 counter drop
}
}
EOF
nft --check --file /etc/nftables.d/cve-2026-98432.nft && nft --file /etc/nftables.d/cve-2026-98432.nft
nft list table inet cve_2026_98432Keep in mind:
- It reduces exposure but is not a fix. Red Hat's bulletin is explicit that a kernel update is the only complete solution.
- It breaks the rare networks that rely on IPv4 options, such as CIPSO or NetLabel security labels. Test before applying to such systems.
- It protects the host network namespace only. Containers with their own networking, and traffic forwarded between containers on the same host, need their own rule.
- Remove it with
nft delete table inet cve_2026_98432once the patched kernel is running.
Has QUAPE been affected?
We have no indication of compromise on our platform. There are no public reports of exploitation anywhere at the time of writing. If you notice unexplained kernel crashes, reboots, new privileged processes or outbound connections on a server you manage, treat it as suspicious and contact support so we can investigate with you.
Timeline
- January 2016: the vulnerable code ships in Linux 4.4.
- 5 October 2026: upstream fix merged; backports follow to all maintained stable kernels between 11 and 18 October.
- 15 October 2026: the Linux kernel CVE team publishes CVE-2026-98432.
- 27 October 2026: Anthropic describes a working remote root exploit built by an internal research model.
- 30 October 2026: Red Hat issues security bulletin RHSB-2026-016 with the interim nftables mitigation.
- 2 November 2026: AlmaLinux ships fixed kernels to production repositories; Ubuntu places fixes in -proposed.
- QUAPE: mitigated at our edge for all hosting customers. We will update this article if anything changes.
Questions
If you are unsure which kernel your server runs, open a support ticket from your account and we will tell you. For anything else related to this advisory, reply to the notification email or contact our team.
References: Linux kernel CVE record CVE-2026-98432 (15 October 2026); Red Hat security bulletin RHSB-2026-016; Debian advisories DSA-6568-1 and DLA-4841-1; Ubuntu CVE tracker; AlmaLinux announcement of 30 October 2026; Anthropic, "Discovering vulnerabilities with Claude", 27 October 2026.
