# Linux TCP bug CVE-2026-98432: Red Hat has fixes now, Ubuntu still doesn't. How to check your servers

> A CVSS 9.8 use-after-free in the kernel's IPv4 TCP handshake code affects kernels back to 4.4, and Anthropic says one of its models wrote a remote-root exploit for it. Red Hat shipped kernels on November 1; Ubuntu users are still waiting. Here's the status by distro and what to do in the meantime.

Published Nov 3, 2026 by TechMeasured Staff · Security · Canonical: https://techmeasured.com/security/linux-kernel-tcp-cve-2026-98432-patch-status-ubuntu-rhel

Red Hat began shipping fixed kernels for **CVE-2026-98432** on November 1, closing the biggest gap in the patch picture for a critical Linux networking bug — but Ubuntu had still not published a fixed kernel as of November 2, according to PBX Science and The Back Room Tech. The flaw is a use-after-free in the code that sets up incoming IPv4 TCP connections, and Red Hat says a remote, unauthenticated attacker could use it for code execution, with no user interaction needed.

Why it matters: this is the kind of bug that touches almost every Linux server. TuxCare traces it to a change that shipped in Linux 4.4 in January 2016, so unpatched kernels from 4.4 onward are affected. The Linux kernel CVE team scored it **9.8**, and Red Hat now rates it Critical after initially listing it as Moderate. And on October 27, Anthropic said an unreleased internal Claude research model wrote a working remote-root exploit for it after "initial prompting," according to The Hacker News.

## What the bug is

Red Hat's bulletin describes a race during TCP connection-request processing: socket option data can be freed while another operation — a retransmitted connection request or socket migration — is still using it. PBX Science says it is triggered by SYN packets carrying IPv4 options. Exploitation needs precise timing, Red Hat says, and systems that accept inbound TCP connections are most exposed. TuxCare says IPv6 doesn't hit the main path and RHEL 7 / CentOS 7 are not affected.

## The Claude exploit claim, and its limits

Per The Hacker News and TuxCare's accounts of Anthropic's post:

- The exploit targeted servers with a **multipath TCP (MPTCP) listener** and gave an unauthenticated attacker root.
- Leaking a kernel address took **48 minutes**; command execution took about **5 more**. A lost race only fails one connection, so an attacker can keep retrying.
- Anthropic has not released the exploit code, kernel version or test setup. TuxCare said it had not reproduced it, and CloudLinux said it couldn't either, per The Back Room Tech.
- No in-the-wild exploitation had been reported, and the CVE was not in CISA's KEV catalog, as of TuxCare's October 30 update.

The MPTCP detail matters for Go shops: Go 1.24 and later request MPTCP on listening sockets by default where the kernel allows it. But the Go Security Team cautions, per The Hacker News, that systems without MPTCP listeners may still be vulnerable to similar attacks — so treat MPTCP as an exposure multiplier, not the whole story.

## Patch status by distro

Tracker pages are changing daily; verify before you act.

| Distro | Status (reported) | Fix |
|---|---|---|
| RHEL 10 | Fixed Nov 1 | RHSA-2026:93413, kernel-6.12.0-211.72.1.el10_2 |
| RHEL 9 | Fixed Nov 1 | RHSA-2026:93412, kernel-5.14.0-687.64.1.el9_8 |
| RHEL 8 | Fixed Nov 1 per PBX Science; The Back Room Tech hadn't found it Nov 2 | RHSA-2026:93414, kernel-4.18.0-553.182.1.el8_10 |
| OpenShift (RHEL CoreOS), RHEL 9 kernel-rt | Still listed as affected | None yet |
| Ubuntu 22.04, 24.04, 26.04, 26.10 | Work in progress | None yet |
| Debian 13 / 12 | Fixed | linux 6.12.113-1 (DSA-6568-1) / 6.1.190-1 (DLA-4841-1) |
| Oracle Linux UEK | Fixed Oct 16 | ELSA-2026-500397/98/99 |
| Amazon Linux 2023 | kernel6.18 and kernel6.12 fixed; default kernel and AL2 pending | ALAS2023-2026-3251, -3335 |

Sources: PBX Science (RHEL), TuxCare and ComputingForGeeks (others). Upstream stable fixes landed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10, per TuxCare. Rocky, Alma and other rebuilds typically follow Red Hat with a delay.

## What to do

**1. Patch and reboot where a fix exists.** Distro kernels backport fixes, so check the changelog rather than the version number (commands per ComputingForGeeks; a count above 0 means you're covered):

```
# RHEL / Rocky
sudo dnf -q updateinfo list --cve CVE-2026-98432
rpm -q --changelog kernel-core-$(uname -r) | grep -c CVE-2026-98432

# Debian
zgrep -c CVE-2026-98432 /usr/share/doc/linux-image-$(uname -r)/changelog.gz

# Ubuntu
pro fix --dry-run CVE-2026-98432
```

**2. If you're on Ubuntu or OpenShift, cut exposure now.** Check whether MPTCP is on and listening:

```
cat /proc/sys/net/mptcp/enabled
sudo ss -Mlnp
```

ComputingForGeeks says Debian 13 and Ubuntu 24.04 default to `net.mptcp.enabled=1`, while EL distros default to 0. Setting it to 0 in `/etc/sysctl.d/` only affects new sockets, so restart listening services. For Go services, set `GODEBUG=multipathtcp=0` (or `godebug multipathtcp=0` in `go.mod`); the Go team calls this fragile, and code that calls `SetMultipathTCP` overrides it.

**3. Consider Red Hat's nftables stopgap.** RHSB-2026-016 provides a table that drops inbound IPv4 TCP packets carrying IP options. Red Hat says it reduces exposure but doesn't fully prevent the bug, can disrupt some workloads, and is "not a substitute for patching." ComputingForGeeks adds that it doesn't cover forwarded container traffic. Remove it after patching with `sudo nft delete table inet cve_2026_98432`.

**4. Don't expose what you don't need.** Fewer internet-facing TCP listeners means fewer places to race.

## What to watch

Canonical's fixed kernels, RHEL CoreOS images for OpenShift, and whether anyone independently reproduces the remote-root exploit. If the CVE lands in CISA's KEV catalog, assume exploitation has started.


## Sources

1. [Red Hat — RHSB-2026-016: Use-after-free in kernel IPv4 (CVE-2026-98432)](https://access.redhat.com/security/vulnerabilities/RHSB-2026-016)
2. [The Hacker News — Linux kernel TCP flaw with 9.8 CVSS score affects Ubuntu, Red Hat and other distributions](https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html)
3. [TuxCare — CVE-2026-98432: Linux kernel TCP flaw, Claude's claimed root exploit and which distros are patched](https://tuxcare.com/blog/cve-2026-98432-linux-tcp-remote-root/)
4. [PBX Science — Red Hat patches critical Linux kernel flaw CVE-2026-98432 in RHEL 8, 9 and 10; OpenShift still listed as affected](https://pbxscience.com/red-hat-patches-critical-linux-kernel-flaw-cve-2026-98432-in-rhel-8-9-and-10-openshift-still-listed-as-affected/)
5. [The Back Room Tech — Critical Linux kernel TCP flaw with 9.8 CVSS score affects Ubuntu, Red Hat and other distributions](https://thebackroomtech.com/cve-2026-98432-linux-kernel-tcp-flaw-ubuntu-red-hat/)
6. [ComputingForGeeks — CVE-2026-98432: check and patch the Linux kernel TCP flaw](https://computingforgeeks.com/linux-kernel-cve-2026-98432/)