Ubuntu Kernel Fixes for CVE-2026-98432 (CVSS 9.8) Land in Proposed Pocket

TL;DR

CVE-2026-98432 is a Linux kernel TCP flaw rated CVSS 9.8. Canonical has now placed fixes in the -proposed pocket for Ubuntu 22.04 LTS and newer. The bug sits in how the kernel sets up IPv4 TCP connections. Every kernel since version 4.4 carries this Linux kernel TCP flaw.

This flaw is a use-after-free race that “can lead to remote code execution.” Ubuntu’s fixes are still in testing, and older releases wait for a later fix. No exploitation in the wild has been reported.

Why It Matters

Almost every Linux server accepts IPv4 TCP connections, so exposure is wide. Anthropic researcher Xinyang Ge reported the bug. According to Canonical’s Luci Stanescu, “the yet-unreleased exploit generated by Anthropic is described as using Multipath TCP (MPTCP).” However, Stanescu adds that “no other exploit is known to have been generated or published.”

How the Attack Works

According to the kernel CVE record, tcp_v4_syn_recv_sock() hands saved IP options to a new socket without copying them. Meanwhile, another CPU may still read those options while it answers a retransmitted SYN. The fix, therefore, frees the options only after an RCU grace period.

Affected Versions

• Fix in -proposed: Ubuntu 22.04 (5.15.0-203.213), 24.04 (6.8.0-149.149) and 26.04 (7.0.0-43.43)
• Fixed: Ubuntu 26.10 (7.3.0-10.10)
• Fix pending: Ubuntu 16.04, 18.04 and 20.04
• Not affected: Ubuntu 14.04

Upstream, the fix ships in stable kernels 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10.

Patch and Mitigation

Canonical tests each kernel on “more than 2,000 certified servers and devices” before moving it to the updates pocket. Admins who run their own kernel tests can install the -proposed builds now, then reboot. Check your running kernel with uname -r.

Some sources suggest disabling MPTCP. Even so, Canonical warns that “the CVE fix is not specific to MPTCP.” The Ubuntu Security Team “believes that security updates are the only appropriate mitigation” for this Linux kernel TCP flaw.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.