CVE-2026-98432: How to Check and Patch the Unpatched Ubuntu Kernel TCP RCE

CVE-2026-98432 is a critical use-after-free bug in the Linux kernel's IPv4 TCP code, scored 9.8 on CVSS, that lets an attacker get remote code execution by sending a single crafted SYN packet to any reachable TCP port. No login, no user click, nothing. And as of today, November 3, 2026, Ubuntu still hasn't pushed the fix past its -proposed testing pocket for any LTS release. If you're running Jammy or Noble in production, you're exposed right now.

I'll walk through what's actually broken, how to check if your box is vulnerable, what you can do today without a reboot, and how to get the real fix once it lands.

What is CVE-2026-98432?

The bug lives in how the kernel handles IPv4 options on an incoming TCP connection request. When a SYN packet carries IP options, the kernel copies them into inet_opt and ireq_opt structures so it can echo them back in the SYN-ACK. The upstream fix description says it plainly: those structures were being freed with a plain kfree() instead of after an RCU grace period, in both inet_sock_destruct() and tcp_v4_reqsk_destructor().

That's a timing bug, not a logic bug. Another CPU can still be reading the freed memory while a socket is being torn down, most easily hit during child socket creation from a SYN request or when net.ipv4.tcp_migrate_req is turned on. Win that race and you've got a use-after-free an attacker can steer.

It's present in Linux 4.4 and later, so basically every kernel shipping today. The fixed upstream versions are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3.

Why this one got more attention than your average kernel CVE

Here's the part that pushed this from "patch it eventually" to "patch it now": Anthropic says an unreleased Claude research model built a working exploit for this bug on its own. The target was a Linux server with a multipath TCP (MPTCP) listener, no credentials, no user interaction. The model spent about 48 minutes leaking kernel addresses to defeat KASLR, then another 5 minutes turning that into root. Call it 53 minutes, start to shell.

That's not a reason to panic about AI taking over the world. It's a reason to take the timeline seriously, because if a model can do it in under an hour during a research exercise, a human with the same patch diff and some patience isn't far behind. There are no confirmed in-the-wild exploits yet, but "no confirmed exploits" and "no exploits" are different sentences.

One more wrinkle worth knowing: CVSS scores for this CVE aren't uniform across vendors. The kernel team and NVD rate it 9.8. Red Hat's own internal score lands lower, around 5.9 to 8.1, and Oracle and SUSE put it at 8.1. Amazon rates it 7.0. Same bug, different blast-radius assumptions depending on default configs. Don't anchor on one number; read the vector string for your own setup.

Am I affected? Check your kernel first

Run this on every box you care about:

uname -r

Then compare against the fixed builds for your distro. For Ubuntu specifically, as of the November 2 proposed-pocket announcement:

Trusty (14.04) predates the vulnerable code path and isn't affected. Everything else, including both current LTS releases most servers actually run, is still sitting on a testing-only fix nineteen days after public disclosure. That's the whole story behind the Hacker News thread titled "Ubuntu still has not released patch for Linux 0day RCE in almost 3 weeks," and it's why a chunk of that thread is people saying they're moving to Debian.

Also check whether MPTCP is even active, since the published exploit specifically targets an MPTCP listener:

sysctl net.mptcp.enabled
sysctl net.ipv4.tcp_migrate_req

Don't relax too much if both come back 0, though. Researchers at CloudLinux flagged that a standard, non-MPTCP TCP/IPv4 path may be exploitable too, it's just less thoroughly demonstrated publicly right now.

Temporary mitigation while you wait for a real patch

If you can't reboot into a -proposed kernel today, do this instead.

Red Hat's security bulletin recommends an nftables rule that drops incoming TCP packets carrying IP options, since that's the trigger condition:

nft add rule ip filter input ip protocol tcp ip hdrlength > 5 counter drop

Test this against your actual traffic before trusting it in production. IP options are rare on modern internet traffic, but if anything in your stack legitimately relies on them, you'll break it silently. Red Hat says it outright in their own bulletin: this reduces exposure, it doesn't close the hole. The kernel update is the only complete fix.

If you don't need MPTCP, turn it off:

sudo sysctl -w net.mptcp.enabled=0

And if you're running Go services that touch TCP directly, there's a debug flag for that specific stack:

GODEBUG=multipathtcp=0

One Hacker News commenter pointed out that eBPF programs and separate network namespaces can bypass netfilter rules entirely, so don't treat the nftables rule as bulletproof on a box where you don't fully control what else is running.

How to patch Ubuntu right now

Since the fix is only in -proposed, you have to opt into it manually:

sudo add-apt-repository "deb http://archive.ubuntu.com/ubuntu $(lsb_release -cs)-proposed restricted main multiverse universe"
sudo apt update
sudo apt install linux-image-generic linux-headers-generic
sudo reboot

After the reboot, confirm you're actually on the fixed build:

uname -r

It should match the version in the table above for your release (for example 5.15.0-203-generic on Jammy). Then, important, remove the -proposed line from your sources once you've confirmed the kernel took. Proposed is a staging pocket for packages still being validated. Leaving it enabled means your next apt upgrade can pull in something that hasn't finished testing. Pin the kernel version if you're nervous, patch, verify, then get back out of proposed.

If you're on Ubuntu Pro with ESM for Xenial, Bionic, or Focal, keep an eye out, those releases are still listed as "fix pending" even on extended support.

What about Red Hat and Debian?

Debian shipped first. Bookworm, Trixie, the testing branch (Forky), and Sid were all patched between October 16 and 22 via DSA-6568-1, roughly a week after disclosure. That's the response time people on Hacker News are holding up against Ubuntu's three weeks and counting.

Red Hat is slower too. RHSB-2026-016, last updated November 2, still describes the fix as in progress for RHEL 8, 9, and 10, plus everything downstream like OpenShift and the RHEL-based virtualization stack. Their recommended stopgap is the same nftables rule above. If you're running RHEL, that's your move until the errata lands.

Oracle Linux and Amazon Linux 2023 both got fixes out in the October 16 to 29 window, ahead of both Ubuntu and RHEL.

Should you be worried right now?

Honestly, yes, more than you'd be about a typical kernel CVE. A 9.8 score with no auth and no user interaction, on code every Linux box runs, is already bad. The fact that a research AI model turned it into a working root shell in under an hour is the part that should move this to the top of your patch queue instead of next sprint's backlog.

That said, I wouldn't lose sleep over mass exploitation tonight. There's no confirmed in-the-wild activity yet, the MPTCP-specific path needs a somewhat uncommon server configuration, and the nftables mitigation genuinely buys you time if you apply it today. What I would do is stop waiting on Ubuntu's normal release cadence and pull the -proposed kernel on anything internet-facing, then schedule the full rollback-safe patch once it hits -updates.

If this kind of scramble feels familiar, it should. We covered a similar supply-chain fire drill with the Brotli HTTP/2 CVE a few weeks back, and the credential-rotation playbook from the LiteLLM backdoor incident is worth rereading too, a lot of the "patch fast, verify harder" discipline carries over directly. And if you've been burned by a tool breach before, our OpenCode key-rotation guide has the general incident checklist.

Watch