Linux Kernel TCP Flaw (CVE-2026-98432): How to Check Your Server and Patch

If you run a Linux server, the Linux kernel TCP flaw tracked as CVE-2026-98432 is the one to patch this week. It lets a remote attacker with no login trigger a memory bug in the IPv4 TCP code, and a fixed kernel only helps once you reboot into it.

Red Hat shipped fixes on November 1, Debian and SUSE did earlier, and Ubuntu is still catching up. Here’s how to check where you stand.

Here are the facts worth knowing before you read further.

• Severity: CVSS 9.8 (Critical) from the kernel CVE team, though some vendors score it 8.1.
• Affected: Linux kernels since 4.4, on the IPv4 TCP path. IPv6 is not hit by the main bug.
• Exploited in the wild: no confirmed attacks, and it’s not in CISA’s KEV catalog as of its October 30 release.
• Check yours: run uname -r and compare it to your vendor’s fixed version.

The short version: if you use RHEL, Debian, SUSE, or Amazon Linux, update and reboot today. Ubuntu admins have a slightly harder choice, covered below.

How the Linux kernel TCP flaw works, in plain English

When a server accepts an IPv4 connection, the kernel hands the IP options from the incoming request to the new socket without copying them. If the client resends its request while another CPU is still reading those options, the kernel can read memory it has already freed.

That’s a use-after-free race. An attacker needs no account. According to The Hacker News, they send connection requests carrying IPv4 Record Route or Timestamp options to any listening TCP port.

Red Hat first rated the bug Moderate (5.9) and later raised it to 9.8. The gap exists because winning the race is hard, but the worst case is remote code execution.

Anthropic said on October 27 that an unreleased internal model wrote a working root exploit. It hasn’t published the code, and Rescana notes the claim is unverified. Treat it as a reason to hurry, not proof of attacks.

Is your server patched? A distro-by-distro check

Most major distros have a fix. Ubuntu is the main one still waiting, as of November 2.

Ubuntu 22.04, 24.04, and 26.04 have fixed kernels, but they sit in the opt-in -proposed pocket for now. Canonical says security updates are the only proper mitigation, so running a server on an unpatched Ubuntu is a real exposure.

Products built on these distros inherit the same status. If you use a managed cloud image or appliance, ask the vendor when it ships a fixed kernel.

How to check and update your kernel in five minutes

Start by seeing what you’re running. This prints your kernel version.

uname -r

On RHEL-family systems, install the errata for your release and reboot. On Debian, SUSE, and Amazon Linux, run your normal update command, then reboot.

On Ubuntu, you can pull the test kernel from -proposed. The Hacker News lists these commands, and they install only the kernel meta-packages.

sudo add-apt-repository --component main --pocket proposed http://archive.ubuntu.com/ubuntu
dpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install -t $(. /etc/os-release && echo $VERSION_CODENAME)-proposed --only-upgrade
sudo reboot

Packages from -proposed are less tested than normal updates. On a production box, try it on a staging machine first. If you use live patching, confirm it actually covers this CVE.

What to do if you can’t patch yet

Nothing replaces the update, but you can shrink the risk while you wait. These steps come from Red Hat and Rescana’s guidance.

• Red Hat published an nftables rule that drops inbound IPv4 TCP packets carrying IP options. It blocks the known trigger, but it can break apps that rely on those options and it won’t stop container-to-container traffic on the same host.
• Confirm net.ipv4.tcp_migrate_req is 0, which is the default. That closes a related migration path only.
• Watch kernel logs for oops messages mentioning ip_options_build or skb_under_panic.

A quiet log doesn’t prove you’re safe, because a lost race may not crash the machine. Use these as stopgaps, not a finish line.

Is anyone actually exploiting it?

No vendor, CERT, or the kernel CVE team has reported attacks so far. A proof-of-concept on GitHub can trigger the race and detect freed memory, but it doesn’t achieve code execution.

That can change quickly. Once a fixed kernel is public, attackers can compare it with the old one and work out the bug. We’ve seen the same pattern in recent security stories like the Android TV box backdoor and the Northflank breach: apply the fix first, then audit.

Frequently Asked Questions

Does the Linux kernel TCP flaw affect my home PC?

Only if it runs a service that listens for incoming TCP connections from the internet. Most desktops behind a home router don’t. Still, install your distro’s kernel update when it arrives.

Do I need to reboot after patching?

Yes. The old kernel stays in memory until you reboot, unless your live-patch service explicitly covers this CVE.

Is disabling MPTCP enough?

No. The bug is in the IPv4 TCP path, so turning off MPTCP doesn’t remove it. Canonical says security updates are the only appropriate fix.

Which kernel versions have the upstream fix?

Rescana lists 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. Your distro may backport the fix under a different version number, so check its advisory.

My take: patch the public-facing servers first

Don’t wait for proof of attacks. Patch anything reachable from the internet today, reboot it, and move to internal machines next. If you’re on Ubuntu with no fix in the regular channel, a tested -proposed kernel on your most exposed host beats leaving it as is.