Exposure Focus
All verdicts

Evidence as of 2026-11-09 (UTC) · Review by 2026-11-23

Linux IPv4 TCP use-after-free

CVE-2026-98432

Tier 2 · Urgent

Red Hat says a race in the Linux kernel's IPv4 TCP code lets an unauthenticated remote attacker corrupt kernel memory. Researchers report remote root against servers with an MPTCP listener, but the exploit is not public and no exploitation is reported.

This tier is for “Internet-facing server with an MPTCP listener”. Other placements are higher or lower; see below.

Remote code executionBreaks: Confidentiality, integrity and availabilitySome facts unconfirmed

Verdict by placement

Your tier depends on where it runs. Find the line that matches your setup.

  • Tier 2

    Internet-facing server with an MPTCP listener

    Handle ahead of your normal cycle. Patch the kernel and reboot.

    Why Tier 2
    • Reachable from the internet.
    • No login needed.
    • Remote root reported by researchers against MPTCP listeners.
    • Exploit not released. No exploitation reported.

    Rubric: Reachable. Business impact: critical. Evidence: credible researcher claim.

  • Tier 3

    Internet-facing server without an MPTCP listener

    Schedule the kernel update sooner than your normal cycle. Move up if an exploit that does not need MPTCP appears.

    Why Tier 3
    • Reachable from the internet.
    • Red Hat says the flaw can lead to code execution, and the bug is not specific to MPTCP.
    • No exploit has been shown or released for servers without an MPTCP listener.

    Rubric: Reachable. Business impact: critical. Evidence: no evidence.

  • Tier 4

    Internal-only server

    Patch in your normal cycle.

    Why Tier 4
    • Not reachable from the internet.

    Rubric: Not reachable from the internet. Routine patching.

Does this apply to you?

Do you run Linux servers that accept IPv4 TCP connections from the internet, and are their kernels unpatched?

How to checkCheck each server's kernel with uname -r against your distribution's security tracker for CVE-2026-98432. Upstream fixes are in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3, but vendor kernels carry their own version numbers, so use the distribution's tracker. To see whether MPTCP listeners exist (the route used in the researchers' exploit), check sysctl net.mptcp.enabled and the listening services.

If you cannot tell, answer Yes.

Patch and mitigate

There are 2 ways in. Each option below says which it closes and which it leaves open.

  • AIncoming IPv4 TCP connection carrying IP options (the base flaw)
  • BRequest-socket migration, if enabled (a similar flaw)

  1. Install a fixed kernel and reboot

    Vendor-stated

    AClosed

    Red Hat calls kernel updates the only complete solution. Upstream fixes are in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Check your distribution's tracker for its fixed kernel.

    Effort
    A kernel update and a reboot of each server. Live patching, where your distribution offers it for this flaw, can avoid the reboot.
    Might break
    A new kernel can change drivers and behaviour. Test first on a representative host.
    Check it worked, undo, guides
    Check it worked
    Run uname -r after the reboot and confirm it matches your distribution's fixed kernel for CVE-2026-98432.
    Undo
    Boot the previous kernel. This reopens the flaw.

  2. Drop IPv4 TCP packets that carry IP options

    Vendor-stated

    APartial mitigation

    Red Hat's temporary nftables rule drops incoming IPv4 TCP packets with IP options (ip protocol tcp ip hdrlength > 5 counter drop, in a table named cve_2026_98432). It takes effect at once for new and existing connections and needs no service restart. Red Hat says it reduces exposure but cannot fully prevent the flaw, and is not a substitute for patching. It is not kept across a reboot.

    Effort
    Loading one nftables table on each server.
    Might break
    Red Hat warns it may disrupt workloads that need IP options, such as CIPSO labelling. It does not cover pod-to-pod traffic in OpenShift.
    Check it worked, undo, guides
    Check it worked
    List the table with nft list table inet cve_2026_98432 and watch its drop counter.
    Undo
    Delete the table, as the bulletin describes, once a fixed kernel is running.

  3. Turn off MPTCP and request-socket migration

    Reported, not yet confirmed

    ALeft open

    Akamai suggests setting net.mptcp.enabled=0 and net.ipv4.tcp_migrate_req=0. Akamai and Red Hat both say this does not stop exploitation, because the bug is not specific to MPTCP. It only blocks the route used in the researchers' exploit.

    Effort
    Two sysctl changes, which can be applied at runtime.
    Might break
    Services that rely on MPTCP stop using it.
    Check it worked, undo, guides
    Check it worked
    Read the two sysctl values back and confirm they are 0.
    Undo
    Set the values back and reload sysctl.

The detail behind this call

Evidence

4 items, as of 2026-11-09
Vendor bulletin · Vendor-stated
Red Hat rates it Critical. An unauthenticated remote attacker can exploit a race with no privileges or user interaction, and exploitation needs precise timing. MPTCP is not a precondition, and default RHEL systems, where MPTCP is off, are still affected. RHEL 8, 9 and 10 and OpenShift Container Platform 4 are listed.
As of 2026-11-09 · Source for Vendor bulletin
Exploit evidence · Reported, not yet confirmed
Akamai says Anthropic reported a root exploit on 2026-10-27 and has not released it, and Akamai knew of no public working exploit when it wrote on 2026-11-02.
As of 2026-11-09 · Source for Exploit evidence
Exploitation status · Reported, not yet confirmed
BleepingComputer reported on 2026-10-30 that there were no confirmed reports of exploitation in the wild. Red Hat and Akamai do not state otherwise.
As of 2026-11-09 · Source for Exploitation status
CVE record · Reported, not yet confirmed
Red Hat's CVE page gives a public date of 2026-10-15 and a CVSS v3 base score of 9.8; the same page shows cve.org also at 9.8 and NVD with no score. Akamai says the Linux kernel CNA published it that day. The score is shown for reference only.
As of 2026-11-09 · Source for CVE record

Any CVSS (Common Vulnerability Scoring System, a general severity score) figure quoted is for reference. It did not set a tier.

Analysis

Some write-ups describe this as an MPTCP-only problem. Red Hat and Akamai both say the bug itself is not specific to MPTCP, while the researchers' exploit uses an MPTCP listener. The record therefore has separate rows for servers with and without one.

As of 2026-11-09 it has not been confirmed whether the flaw is in the CISA KEV catalogue.

Sources

4