The flaw in thirty seconds

CVE-2026-98432 is a use-after-free race in the IPv4 TCP handshake code, the part of the kernel that answers incoming connections. Two CPUs can process the same connection request at once: one frees the socket's IP options while the other is still reading them, so the second one reads memory that has already been released. The kernel CVE team scores it 9.8 out of 10, Critical: a remote attacker needs no account and no user interaction, only a reachable TCP port. The flaw has been in the code since kernel 4.4 (2016), and IPv6 is not affected by this particular path. The upstream fix, merged on 5 October, is a two-line change: free the option structures with kfree_rcu() so they survive until every reader is done.

Why this one moved faster than most

On 27 October, Anthropic's Frontier Red Team published research showing an unreleased internal Claude model had turned the flaw into a working exploit: a zero-click remote root shell against a server with a Multipath TCP (MPTCP) listener. In its lab test, leaking a kernel pointer took 48 minutes and reaching a shell took five more, and a failed attempt does not crash the target, so an attacker can keep retrying. Anthropic has not published the exploit code, no exploitation in the wild had been reported in checks published during the first week of November, and the flaw had not appeared in CISA's Known Exploited Vulnerabilities catalog in those checks.

On 2 November, security researcher Marcus Hutchins reported residential proxies and Russia-based VPNs scanning the internet on port 443 with MPTCP connections, activity his team suspects is aimed at this flaw. The window between disclosure and weaponization is shrinking: an AI model wrote this exploit in weeks, not months.

Who has patched, and who has not

Patch status as checked on 9 November 2026:

  • Debian: fixed. Debian 12 ships linux 6.1.190-1 in bookworm-security.
  • Red Hat: fixed. RHEL 8, 9 and 10 received fixed kernels on 1 November (RHSA-2026:93414 for RHEL 8, RHSA-2026:93412 for RHEL 9).
  • SUSE, AlmaLinux, Rocky Linux and Amazon Linux: fixed. Patched kernels landed between late October and 3 November.
  • Ubuntu 26.10: fixed in linux 7.3.0-10.10.
  • Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS: still vulnerable. The fixed kernels (5.15.0-203.213, 6.8.0-149.149 and 7.0.0-43.43) sit in Ubuntu's -proposed testing pocket, where Canonical says it is qualifying them on more than 2,000 certified servers and devices. Ubuntu's tracker, last updated 7 November, still lists all three as "vulnerable, work in progress". Older LTS releases (20.04, 18.04 and 16.04) are in the same position.

Ubuntu's position, published 2 November, is blunt: security updates are the only appropriate mitigation. Disabling MPTCP only closes the one exploit path Anthropic demonstrated; the flaw itself does not need MPTCP. Red Hat agrees: RHEL disables MPTCP by default and is still vulnerable.

What to do on Ubuntu LTS right now

First, check what you are running:

BASH
uname -r
apt-cache policy linux-image-generic

If your kernel is older than the fixed version for your release, you are waiting with everyone else. Do not enable the -proposed pocket on a production server to grab the fix early: that is where Canonical tests packages before release. Wait for the security update, install it, and reboot the same day, because a kernel patch only takes effect after a reboot: our reboot-after-patch playbook. Snapshot the machine first if you can: our Timeshift backup guide.

While you wait, Ubuntu's CVE page publishes an interim nftables rule that drops inbound IPv4 TCP packets carrying IP options, the trigger this exploit needs. It is a filter, not a fix, and it breaks connections that genuinely rely on IP options, so test it before you trust it:

BASH
printf '%s\n' 'table inet cve_2026_98432 {
chain input {
  type filter hook input priority -310; policy accept;
  ip protocol tcp ip hdrlength > 5 counter drop
}
}' | sudo tee /etc/cve-2026-98432.nft >/dev/null

sudo nft -c -f /etc/cve-2026-98432.nft &&
sudo nft -f /etc/cve-2026-98432.nft

Make it survive a reboot, and remove it once the patched kernel is installed and the machine has rebooted:

BASH
echo 'include "/etc/cve-2026-98432.nft"' | \
sudo tee -a /etc/nftables.conf
sudo nft -c -f /etc/nftables.conf &&
sudo systemctl enable nftables.service

# After patching and rebooting:
sudo nft delete table inet cve_2026_98432

Containers with their own networking need the rule applied separately, and if you run UFW, this sits underneath it: our UFW setup guide. While you are at it, close the public ports you forgot about: a machine with no public TCP listeners is a much smaller target. The kernel patch wave earlier this month is a reminder that the handshake code itself is now a target: seven kernels, one Saturday.

The takeaway

The fix has existed since 5 October, ten days before the CVE was even published, and Debian shipped it the next day. The gap that matters now is not the fix, it is the rollout: Ubuntu LTS, the release that runs a huge share of the world's servers, is still qualifying its kernels while scanners are already probing for the flaw. Patch the day the update lands, reboot the same day, and keep the nftables rule in place until then.

Sources