Vulnerability advisoryFri, 30 Oct 2026
Linux kernel TCP flaw: identify reachable services and patch the running kernel
CVE-2026-98432 affects TCP connection handling. A research demonstration achieved remote root command execution with a specific Multipath TCP listener.
Article
The flaw involves a race condition in IPv4 TCP connection requests and particular socket migration paths. Ubuntu published its notice October 15 and updated it October 29, 2026, with CVSS v3 at 9.8. Red Hat’s preliminary CVSS v3.1 score for its products was 8.1. The scores use different assessments of attack complexity.
Anthropic’s October 27 research demonstrated remote execution under specific Multipath TCP listener conditions. The demonstration does not establish real-world exploitation. As of October 30, Ubuntu marked fixes in progress for its main linux packages on 26.10, 26.04, 24.04 and 22.04. Debian lists fixed security package versions of 6.1.190-1 for bookworm linux, 6.12.113-1 for trixie linux and 6.12.113-1~deb12u1 for bookworm linux-6.12. Verify cloud, HWE and other kernel variants separately.
- 01
Reach the listener
Exposure depends on reachable services and kernel settings.
- 02
Trigger the race
A particular IPv4 TCP connection and socket migration path can corrupt memory.
- 03
Assess host impact
The demonstration reached root command execution with Multipath TCP. Other configurations need separate assessment.
What to do: from the perimeter to internal systems
- 01
Map reachable hosts
Include cloud workloads, container hosts, managed infrastructure and internal services.
See what to doResources: 1
TWISA member solutions
Map reachable hosts
Include cloud workloads, container hosts, managed infrastructure and internal services.
- 02
Match packages to vendor fixes
Identify distribution, branch and the kernel actually running. Prioritize exposed systems.
- 03
Reduce reachability
Limit access and segment services while vendor updates are pending.
See what to doResources: 1
TWISA member solutions
Reduce reachability
Limit access and segment services while vendor updates are pending.
- 04
Verify after maintenance
Boot into the corrected kernel, check services and investigate unexplained crashes.
See what to doResources: 1
TWISA member solutions
Verify after maintenance
Boot into the corrected kernel, check services and investigate unexplained crashes.
TCP services, host kernels and network boundaries
Allow authorized traffic and apply controls at each layer.
- 01
Map reachable hosts
TCP services, host kernels and network boundaries
Validate the controlInclude cloud workloads, container hosts, managed infrastructure and internal services.
- 02
Match packages to vendor fixes
TCP services, host kernels and network boundaries
Validate the controlIdentify distribution, branch and the kernel actually running. Prioritize exposed systems.
- 03
Reduce reachability
TCP services, host kernels and network boundaries
Validate the controlLimit access and segment services while vendor updates are pending.
Feed logs and traffic data from each layer into monitoring and response.
- Verify after maintenanceBoot into the corrected kernel, check services and investigate unexplained crashes.
Test and verify
Use authorized asset discovery, vulnerability scanning, penetration and API testing, and attack simulation. Retest after changes and verify monitoring against actual system behavior. Verify the host kernel independently of any application WAF.
TWISA member solutions
Map reachable hosts
Include cloud workloads, container hosts, managed infrastructure and internal services.
Reduce reachability
Limit access and segment services while vendor updates are pending.
Verify after maintenance
Boot into the corrected kernel, check services and investigate unexplained crashes.
Sources and further reading
- Ubuntu package status
- Debian affected and fixed packages
- Red Hat product status and scoring
- Anthropic research demonstration
- Read the full article in Traditional Chinese
Alert updated: 2026/10/30. Check the vendor’s latest guidance for product support and patch status.