CVE-2026-98432: Your Linux Server May Be Vulnerable Right Now — A Shop Owner's Guide
By Arash Latifi — Founder, The DevArt
A critical Linux kernel hole (CVSS 9.8) is still unpatched on Ubuntu and RHEL. A two-command check, a safe-version table, and interim mitigations until you can patch.
TL;DR —
CVE-2026-98432is a CVSS 9.8 use-after-free in the Linux IPv4 TCP handshake that lets an unauthenticated remote attacker reach root; upstream fixes shipped Oct 15, but Ubuntu and RHEL kernels were still unpatched as of Oct 31 — check your kernel now and apply the interim mitigations.
What happened
On October 15, 2026, a use-after-free in the Linux kernel's IPv4 TCP handshake was published with a CVSS 9.8 (Critical) score. The bug dates back to Linux 4.4 — meaning nearly every Linux server on the planet. Three things make it worse than the usual CVE churn:
- It triggers before your app runs. The flaw lives in code every Linux server executes when accepting an IPv4 TCP connection — a static site or a plain container is just as exposed.
- No credentials needed. The kernel CNA scores it AV:N/AC:L/PR:N/UI:N — network-reachable, unauthenticated.
- Anthropic reported that Claude wrote a working exploit achieving root on servers with a
multipath TCPlistener, and the Go Security Team noted Go programs open such listeners by default.
Red Hat's bulletin: an unauthenticated attacker "could exploit a race condition during TCP connection request processing to trigger remote code execution." Consequences include kernel heap disclosure, memory corruption, or crash. The exploit itself hasn't been published.
Why a shop owner should care
Your VPS, dedicated box, or Next.js render server runs one of these kernels. Root access to your shop's server means customer databases, login sessions, and payment integrations are all exposed.
Check your server
SSH in and run:
Compare against the fixed upstream releases:
| Branch | Fixed in | |---|---| | 7.3 | mainline (Oct 18) | | 7.2 | 7.2.10 | | 6.18 | 6.18.56 | | 6.12 | 6.12.113 | | 6.6 | 6.6.159 | | 6.1 | 6.1.190 | | 5.15 | 5.15.223 | | 5.10 | 5.10.272 |
If you run a distro kernel (Ubuntu, RHEL, Debian), distro versions carry their own numbering — the source of truth is the distro's security tracker, not the upstream number:
As of October 31: Ubuntu listed the kernel "Vulnerable" on every release, and RHEL 8, 9, and 10 had no fix (Red Hat raised severity to Critical on Oct 30). Debian, current SUSE Enterprise, Oracle UEK, and Amazon Linux already shipped fixed kernels; AlmaLinux's were in testing.
Can't patch yet? Mitigate
Until a fixed kernel lands, apply Atlas's interim rules:
And after patching, reboot — an installed kernel does nothing until the machine restarts into it.
Today's checklist
Related: Anatomy of a ChatGPT Account Takeover.
- [ ] Ran
uname -rand compared with the table above - [ ] On Ubuntu/RHEL, checked the distro tracker (not just the upstream number)
- [ ] Patch available? Installed and rebooted
- [ ] No patch yet? Applied the IPv4-options DROP rule and disabled MPTCP
- [ ] Patched hosts with
multipath TCPlisteners first (Go opens them by default) - [ ] Took a fresh backup before rebooting
FAQ
Q: I'm on shared hosting — what do I do?
A: Open a support ticket and ask directly: "Is your kernel patched for CVE-2026-98432?" This flaw has nothing to do with your app — it's whoever manages the kernel.
Q: Is IPv6 affected?
A: Per the upstream commit, "IPv6 is not affected by the first issue" — the bug is in the IPv4 TCP handshake. Patch anyway; you don't want to gamble on what ships next.
Q: How do I confirm the patch after rebooting?
A: Run uname -r again and compare with the table. For distro kernels, check the package version (e.g. linux-image-x.x.x-XX) against your distro's security advisory — distro versions differ from upstream.