Linux Kernel TCP Flaw CVE-2026-98432: What Is Confirmed and Which Ubuntu, RHEL and Debian Kernels Are Fixed

A bug in the part of Linux that sets up new network connections, tracked as CVE-2026-98432, can let an attacker on the internet crash a server. In one lab test reported by its finders, it gave the attacker full control. If your business runs a website, app or database on Linux (Ubuntu, Red Hat, Debian, Amazon Linux and others), plan a kernel update and a reboot. On some systems the fix has not shipped yet, so you need to know which machines are waiting.

What is CVE-2026-98432?

CVE-2026-98432 is a use-after-free bug in the Linux kernel's IPv4 TCP code. A use-after-free means the kernel keeps reading memory it has already released. According to the descriptions published by Ubuntu and Debian, it happens during the TCP handshake. When a new connection is set up, the kernel hands some stored IP options to the new socket without copying them. If that socket is destroyed while another CPU is still using those options to answer a retransmitted connection request, the kernel reads freed memory. Ubuntu notes a second path to the same bug during request socket migration, which only applies when net.ipv4.tcp_migrate_req=1 is set or a BPF reuseport migration program is in use.

The fix makes the kernel wait before freeing that memory. The Linux kernel CVE team's record says the bug was introduced in Linux 4.4 and that IPv6 is not affected by the main issue. The CVE was published on Thursday, October 15, 2026, according to Ubuntu's and Amazon's CVE pages.

How serious is the Linux kernel vulnerability? The scores disagree

Scores range from 8.1 to 9.8. The difference is how hard each scorer thinks the attack is.

Red Hat, Oracle and Amazon all rate the attack as hard because the attacker has to win a timing race. Red Hat's description says the main impact is a system crash or possible memory corruption. Either way, the attacker needs no login and no user interaction.

Claimed vs confirmed: did an AI write a working exploit?

Confirmed by primary sources: the bug exists, it is fixed upstream, and vendors are shipping or preparing fixes. The kernel CVE team's fixed versions are listed below.

Claimed by Anthropic: in a research post dated Tuesday, October 27, 2026, Anthropic says an "unreleased, internal research model" wrote an exploit that lets a remote attacker send packets to Linux servers with a multipath TCP (MPTCP) listener and run a command as root. Anthropic describes two stages. First, the race leaks a kernel address, which defeats a protection called KASLR. Second, the attacker overwrites a callback pointer and runs a chosen shell command as root. Anthropic says the leak took 48 minutes and command execution took another five. It also says a lost race only fails the handshake and does not crash the system, so an attacker can keep retrying.

Not known:

• The post does not include exploit code, the kernel version tested or the test setup.
• The CVE record and the kernel fix do not mention MPTCP. That link comes only from Anthropic's post.
• It is not confirmed whether a typical server setup can be exploited the same way.
• None of the vendor pages we checked (Ubuntu, Red Hat, Debian, Oracle, Amazon) report attacks in the wild.

So "remote root on any Ubuntu or RHEL server" goes further than the evidence. The accurate version: this is a serious, remotely reachable kernel bug, and its finders say they turned it into root in their own test.

Which Linux kernel versions are affected and fixed?

The kernel CVE team lists these fixed upstream versions: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Its advice is to update to the latest stable kernel and not to cherry-pick individual patches. Most businesses get kernels from their distribution, so the distribution's status is what counts. Status as of Thursday, October 29, 2026:

Ubuntu cloud kernels (AWS, Azure, GCP, Oracle) and FIPS kernels are also listed as in progress or vulnerable, depending on the release.

What to do this week

1. List every Linux machine you depend on. Include cloud servers, VPS hosting, firewalls and appliances built on Linux, and container hosts. Containers share the host's kernel, so the host is what needs patching.
2. Check the running kernel. Run uname -r on each machine and compare it with your distribution's page for CVE-2026-98432.
3. Where a fix exists, install it and reboot. A new kernel does nothing until the machine restarts into it. We covered this trap in Updated Is Not the Same as Patched.
4. Where no fix exists yet (Ubuntu, RHEL), watch the vendor page. Schedule a reboot window now so you can patch the day the kernel lands.
5. Reduce what is exposed. Close any port the internet does not need. Ask whoever runs each server whether any service listens with multipath TCP, since that is the setup Anthropic says it exploited. Leave net.ipv4.tcp_migrate_req off unless you know you need it.
6. Ask your hosting provider. If they manage the operating system, ask in writing when your kernel will be updated and rebooted.
7. Take unexplained crashes seriously. Red Hat says the main impact is a crash, so a run of unexplained reboots on an internet-facing server is worth a look.

Why it matters for a company network or website

The kernel sits underneath everything else. A flaw here bypasses the protections in your web server, your app and your database, because they all run on top of it. Most businesses do not know which kernel their servers run or who is responsible for rebooting them. That gap matters more than the score. Read Who Is Patching the Software That Runs Your Business? for how to assign that job. If you host your own systems, our self-hosting infrastructure page explains how we set up patching and reboot schedules.

The AI angle is also worth noting. If research models can turn a timing bug into a working exploit, the gap between a patch and an attack is likely to shrink. Waiting a month to reboot is a bigger risk than it used to be.

CVE-2026-98432 questions people are asking

Is CVE-2026-98432 being exploited in the wild?

Not as far as we can confirm. None of the Ubuntu, Red Hat, Debian, Oracle or Amazon pages we checked report active attacks, and Anthropic has not published its exploit.

Does CVE-2026-98432 affect Ubuntu?

Yes. Ubuntu rates it High priority. Fixes for 22.04, 24.04, 26.04 and 26.10 were still in progress on October 29, and 16.04 to 20.04 are marked vulnerable.

Does it affect Red Hat Enterprise Linux?

RHEL 8, 9 and 10 and OpenShift 4 are listed as affected, with no mitigation available. RHEL 6 and 7 are not affected.

Is there a workaround for the Linux kernel TCP flaw?

No vendor has published one. Red Hat says no mitigation meets its standards. The fix is a patched kernel plus a reboot.

Did an AI really write a Linux kernel exploit?

Anthropic says one of its internal research models did, and it describes the exploit's stages and timings. That is Anthropic's own claim. No code or test setup has been published for others to check.

Do I need to reboot after the kernel update?

Yes. Without a reboot the old, vulnerable kernel keeps running.

The bigger lesson

The score matters less than the routine. A business that knows which servers it runs, checks vendor pages and reboots on schedule handles a bug like this in an afternoon. Without that routine, nobody knows whether you were exposed.

To harden your servers, see security hardening, or get a quote for ongoing patching.

Get security alerts like this by email, plus our free checklist, at /security-alerts.

Sources: Linux kernel CVE team record; Anthropic research post; Ubuntu CVE-2026-98432; Red Hat CVE-2026-98432; Debian security tracker; Oracle Linux CVE page; Amazon Linux CVE page.