A Linux kernel TCP vulnerability tracked as CVE-2026-98432 is the server security story of the week, and the reason is simple: it lives in code that nearly every internet-facing Linux host runs, it can be reached before any login, and the fixes are still arriving unevenly. The Hacker News reported on November 3 that fixed kernels are now available for Red Hat Enterprise Linux 8, 9 and 10, while Ubuntu’s fixes for its three newest long-term-support releases remain in an opt-in testing channel. That gap between a public flaw and a fix on your distribution is what this article calls the kernel exposure window, and it is where enterprise networks get hurt.

Linux kernel TCP vulnerability (CVE-2026-98432): a use-after-free flaw in the Linux kernel’s IPv4 TCP handshake code, present since kernel 4.4, that a remote, unauthenticated sender can reach with crafted connection requests carrying IP options. The kernel CVE team rates it 9.8 out of 10. Researchers have demonstrated remote root access, and the fix is to install a patched kernel and reboot.

Key Takeaways

• This Linux kernel TCP vulnerability can be reached over the network, before authentication, on a default TCP listener.
• Ubuntu 22.04, 24.04 and 26.04 LTS fixes were still in the proposed channel on November 3.
• Network-layer filtering of IP options can shrink exposure while you patch, and it protects hosts you cannot reboot yet.
• Treat the kernel exposure window, not the CVSS number, as the metric that matters.

What Is the Linux Kernel TCP Vulnerability, in Plain English?

When a Linux server accepts an IPv4 TCP connection, the kernel hands the connection request’s IP options to the new socket without copying them. According to Ubuntu’s security record, the child socket later frees those options with a plain free call, which produces a use-after-free in the code that builds IP options. If a client retransmits its connection request while another processor is still reading the same memory, the race can leave the kernel using memory it has already released.

Red Hat’s security bulletin states that exploitation needs precise timing but no privileges and no user interaction. The bug has existed since Linux 4.4, and the upstream fix landed in early October. The CVE record followed on October 15, which is the day the clock started for every defender.

Why This Linux Kernel TCP Vulnerability Is Different From a Typical Critical CVE

Most critical flaws need a specific application, a misconfiguration or a stolen credential. This one sits in the networking stack itself, so the vulnerable component is not an optional service you can uninstall. A server that accepts IPv4 TCP connections is a candidate. AWS’s bulletin 2026-160-AWS describes the result as a possible kernel crash, disclosure of kernel memory or memory corruption, and notes that researchers demonstrated unauthenticated remote code execution against hosts with a Multipath TCP listener.

The second difference is the author of the exploit. CSO Online reported that an unreleased Claude research model developed a zero-click exploit that gives a remote attacker root, and that the model bypassed kernel address randomization in about 53 minutes. That pace fits the wider trend behind Project Glasswing, where AI finds serious bugs before criminals do.

The MPTCP Question: What Is Proven and What Is Not

Much of the early coverage focused on Multipath TCP, and that focus can mislead. The demonstrated root exploit targets servers with an MPTCP listener. The Go Security Team’s announcement, forwarded to the oss-security list, points out that Go programs have enabled MPTCP by default for Linux listen sockets since Go 1.24, so many Go services may be exposed without anyone choosing it. The same notice cautions that systems without MPTCP listeners could be open to similar attacks, and Red Hat’s bulletin says MPTCP is not a required condition.

The practical reading is straightforward. Disabling MPTCP, or setting GODEBUG=multipathtcp=0 for Go programs, removes the one path researchers have proven. It does not remove the bug. Use it as a speed bump, never as the fix.

Patch Status on November 3, 2026

Status changes hourly, so verify against each vendor’s tracker. This snapshot comes from The Hacker News, Red Hat’s CVE page and Ubuntu’s tracker.

Exploitation status deserves precision. No vendor, CERT or kernel team had reported attacks as of The Hacker News’s November 3 report, and the flaw was absent from the CISA Known Exploited Vulnerabilities catalog in its October 29 update. A November 3 Cyber Security News headline does say attackers have started scanning, and proof-only code that triggers the race has appeared on GitHub. Prepare as though exploitation is coming, because the research already proved it can.

The Kernel Exposure Window: A Metric Worth Tracking

CVSS tells you how bad a flaw can be. It does not tell you how long you are exposed. The kernel exposure window is the number of days between a network-reachable kernel flaw becoming public and the fix being running on every host that faces traffic, including the reboot. For Red Hat customers on this flaw, the gap between the October 15 CVE record and the first fixed kernels is roughly 19 days. For Ubuntu LTS users it is still open.

That matters because industry remediation is slow. The Verizon DBIR 2026 reported that only about a quarter of known exploited vulnerabilities were fully remediated and that the median fix took 43 days, figures we covered in our risk-based vulnerability management guide. When the window is 43 days and a research model needs under an hour, the arithmetic favors the attacker unless something else closes the gap. That something is the network.

Network-Layer Controls That Shrink the Linux Kernel TCP Vulnerability Window

Red Hat’s bulletin offers a mitigation that network teams can recognize immediately: drop IPv4 TCP packets whose header carries IP options. The published nftables rule is ip protocol tcp ip hdrlength > 5 counter drop, and Red Hat says to remove it after the kernel is updated. Legitimate application traffic almost never carries IP options, so it is a low-collateral filter. Test it first, because some legacy diagnostics use options.

ip protocol tcp ip hdrlength > 5 counter drop

Move the Control to the Edge: Where the Filter Belongs

Host rules protect only the host that carries them. A better home for the same policy is the edge: a next-generation firewall, load balancer or gateway that normalizes traffic before it reaches Linux. Consider where that control can live in your design:

• Perimeter firewalls: drop or scrub IPv4 options on inbound TCP to server segments, as described in NIST SP 800-41 Rev. 1 on firewall policy.
• Load balancers and proxies: terminate TCP in front of the kernel. AWS notes that its Network Load Balancer TCP listeners pass client packets, including IP options, through to targets, so a pass-through balancer is not protection by itself.
• Segmentation: keep servers that cannot be rebooted today off the public internet and behind a policy enforcement point, consistent with boundary protection in NIST SP 800-53 Rev. 5.
• Detection: watch for repeated SYN retransmissions that carry IP options toward a single listener, then correlate with kernel crash or restart events.

The NSA Network Infrastructure Security Guide makes the same point: perimeter and internal filtering buy time when a vendor patch is late.

Where Linux Hides in Your Network

The servers you manage are the easy part. The harder inventory is every device whose operating system is Linux even if nobody calls it that. Gateways, VPN concentrators, reverse proxies, load balancers, storage appliances, SD-WAN edge devices and Kubernetes nodes frequently run Linux kernels that the appliance vendor, not you, patches. Ask each vendor in writing whether the appliance kernel is affected and when a fix ships, then compensate at the network layer until it does.

It is the same ownership gap we saw when KeyDrift targeted SD-WAN control planes and when a VMware ESX logging flaw let spies hide.

Applying CISA’s BOD 26-04 Logic to This Flaw

CISA’s Binding Operational Directive 26-04 asks federal agencies to prioritize fixes using four criteria, including whether the asset is publicly exposed, whether the flaw is in the KEV catalog, how automatable exploitation is, and the technical impact. CISA’s release encourages all organizations to adopt similar actions. In our reading, this flaw already meets several of the risk criteria on internet-facing hosts: public exposure, network reachability and potential total system control. Only KEV status is missing, and KEV status is a lagging indicator by design.

The lesson is to prioritize internet-facing Linux first, then hosts that front sensitive data, then everything else. NIST SP 800-40 Rev. 4 supports exactly this approach, recommending maintenance plans that account for emergency and routine patching and for cases where a patch is not yet available.

What Regulated Industries Should Do Now

Financial services and insurance

Banks and carriers face examiner questions about patch timelines for internet-facing systems. The FFIEC IT Handbook expects risk-based patch management, and New York’s 23 NYCRR Part 500 requires vulnerability management and risk-based controls. Document the compensating control you applied while Ubuntu fixes were pending, because that record is your answer to “what did you do in the meantime.” Public companies should also remember the SEC cybersecurity disclosure rule when a kernel flaw leads to a material incident.

Healthcare

The HIPAA Security Rule requires ongoing risk analysis and risk management, which covers Linux servers that process patient data. Clinical systems often cannot be rebooted at will, so isolation and option filtering come first, as our medical device cybersecurity analysis explains.

A 7-Step Plan for the Linux Kernel TCP Vulnerability

1. Inventory by exposure. List every Linux system that accepts IPv4 TCP from outside its trust zone, including appliances and Kubernetes nodes.
2. Check the running kernel. Compare each host against your vendor’s fixed version; do not trust the installed package list alone.
3. Filter IP options at the edge. Apply the drop rule on firewalls and load balancers first, then on hosts you cannot patch.
4. Reduce reachability. Remove public exposure from servers that do not need it and enforce zero-trust segmentation.
5. Patch in risk order and reboot. Internet-facing first, sensitive data second; schedule the reboot, because an installed kernel is not a running kernel.
6. Watch for abuse. Alert on handshake anomalies and unexpected kernel crashes using anomaly detection and response.
7. Record the window. Log the dates for disclosure, mitigation and fix on each system so you can show regulators and insurers how long you were exposed.

How ibm/SEIMless and Exodus Help You Shorten the Window

For more than 20 years, ibm/SEIMless has stayed vendor agnostic across carrier, cloud and communications services, which means we can compare what the network can do against what each distribution vendor is shipping. With Exodus, our quantum resistant networking suite, we focus on the controls that work before a patch exists, which is exactly what a Linux kernel TCP vulnerability demands. Capabilities vary by design, so we confirm scope in a design review.

• Exodus NxtGen Firewall enforces policy at the edge so hostile packets can be stopped before they reach Linux hosts.
• Exodus Aria ADR adds anomaly detection and response for unusual traffic patterns.
• Exodus Key Management reduces the damage of a root compromise by controlling where keys live.
• Data in Motion and Data at Rest protection limit what an intruder can read after a foothold.
• EDR for endpoints and servers and backup and recovery support containment and restoration.

Root access also has a long tail. Stolen keys and traffic captured today can be decrypted after quantum computers mature, a risk we explain in our guides to quantum computing and encryption, Executive Order 14412 and certificate lifecycle management. Network-wide reviews also pair well with SD-WAN, MPLS replacement and private and hybrid cloud designs, where Linux gateways multiply.

What to Watch Next on the Linux Kernel TCP Vulnerability

Three signals will tell you how fast the window is closing. First, Canonical promoting its fixes from the proposed pocket to the regular security channel. Second, any move of CVE-2026-98432 into the KEV catalog, which would trigger federal deadlines and instant board attention. Third, public exploit code that goes beyond triggering the race. Discovery now outruns patching, a theme from our AI agent botnet warning post, so layered network defense is no longer optional.

For a wider view of exploit trends, the Verizon Data Breach Investigations Report, CISA’s Secure by Design guidance and the NIST Cybersecurity Framework 2.0 are useful anchors for board reporting. For the original disclosure coverage, see The Hacker News’s October report and BleepingComputer’s BOD 26-04 coverage.

Frequently Asked Questions About the Linux Kernel TCP Vulnerability

What is the Linux kernel TCP vulnerability CVE-2026-98432?

A use-after-free flaw in the kernel’s IPv4 TCP handshake code, present since kernel 4.4, reachable by a remote, unauthenticated sender. The kernel CVE team rates it 9.8, and Red Hat now rates it Critical.

Is the Linux kernel TCP vulnerability being exploited in the wild?

Not confirmed as of November 3, 2026, and it was absent from CISA’s KEV catalog on October 29. Still, a remote root exploit was demonstrated and proof-of-trigger code is public, so act first.

Does disabling MPTCP protect me?

Not reliably. The demonstrated exploit used an MPTCP listener, but Red Hat and the Go Security Team say the flaw is not MPTCP-specific. A fixed kernel is the real fix.

Which distributions have a fix?

Red Hat Enterprise Linux 8, 9 and 10 have fixed kernels, and Debian, Oracle Linux, SUSE and Amazon Linux shipped fixes in October. Ubuntu’s newest three LTS fixes were still in the proposed channel on November 3.

Can I block the attack at the firewall until I patch?

Red Hat’s bulletin describes an nftables rule that drops IPv4 TCP packets carrying IP options. Test it first, remove it after updating, and apply it upstream to protect hosts you cannot reboot yet.

Is installing the patched kernel enough?

No. A kernel update takes effect only after a reboot or supported live patch. Verify the running version, inventory hidden Linux systems, and review logs for unusual handshakes during the exposure window.

Close Your Kernel Exposure Window With ibm/SEIMless

Whether your servers run Red Hat, Ubuntu or a mix, ibm/SEIMless and Exodus QRN can help you map exposure to this Linux kernel TCP vulnerability, apply network-layer controls and build a security design that does not wait on a vendor patch. Speak with an engineer today.

Get StartedContact Us

Call: 646-546-5245
Email: in**@**********ss.com
Address: One Liberty Plaza, New York, NY 10006