{"slug":"linux-kernel-tcp-uaf-cve-2026-98432","title":"Linux kernel CVE-2026-98432: remote use-after-free in IPv4 TCP","shortName":"Linux TCP","summary":"Use-after-free in the Linux kernel IPv4 TCP SYNACK path (inet_opt / ireq_opt). Kernel CNA CVSS 3.1 9.8. Anthropic demonstrated remote root against a server with an MPTCP listener (27 Oct 2026; proof of concept, Anthropic's wording). The Go Security Team says the bug is not MPTCP-specific. Not in CISA KEV (catalog 2026.10.29, checked 30 Oct 2026). No known ITW. No public PoC indexed. One public race-trigger, oracle and leak-analysis repo exists (H1z3-br0, 30 Oct 2026); its README says it is not a root exploit.","isExample":false,"draft":false,"family":"linux-kernel-tcp-uaf-cve-2026-98432","kind":"single-product","aliases":["CVE-2026-98432","Linux kernel IPv4 TCP use-after-free","ipv4: free inet_opt and ireq_opt after an RCU grace period"],"publishedAt":"2026-10-30","updatedAt":"2026-10-30","patchStatus":"partly-patched","exploited":false,"scores":{"cve":"CVE-2026-98432","cvss":{"cve":"CVE-2026-98432","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98432","sourceDate":"2026-10-15","checkedDate":"2026-10-30","dateLabel":"CNA dated","sourceLabel":"NVD record (CNA metric; NVD status Received)","nvdPublishedDate":"2026-10-15"},"epss":{"cve":"CVE-2026-98432","score":0.00388,"percentile":0.32813,"date":"2026-10-29","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-98432","checkedDate":"2026-10-30"},"kev":{"cve":"CVE-2026-98432","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.10.29","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-30"},"addedDate":"2026-10-30"},"priority":{"label":"high"},"managementSummary":{"what":"Linux kernel IPv4 TCP use-after-free (CVE-2026-98432, CNA CVSS 3.1 9.8). Anthropic demonstrated remote root against a server with an MPTCP listener (27 Oct 2026; proof of concept, Anthropic's wording). The Go Security Team says the bug is not MPTCP-specific. Not in CISA KEV (checked 30 Oct 2026). No known ITW. No public PoC indexed. One public race-trigger and leak-analysis repo exists; it is not a root exploit.","action":"Patch to a fixed kernel and reboot. Check the vendor package, not only the upstream number. Red Hat says no mitigation meets its bar. For Go 1.24+ services, GODEBUG=multipathtcp=0 is a fragile opt-out (Go Security Team). Hunt MPTCP listeners with ss -lnMp and kernel logs for skb_under_panic or KASAN in ip_options_build."},"seenInTheWild":[],"seenInTheWildLinks":[],"whatChanged":{"date":"2026-10-30","items":[{"text":"Debian, SUSE (most LTSS), Oracle UEK, and parts of Amazon Linux 2023 have shipped fixes. Ubuntu and RHEL had not as of the tracker pages read on 30 Oct 2026.","headline":"Debian, SUSE, Oracle UEK, and Amazon Linux 2023 shipped fixes; Ubuntu and RHEL had not","section":"fixed-versions","date":"2026-10-30","sourceUrl":"https://security-tracker.debian.org/tracker/CVE-2026-98432","alsoSourceUrl":"https://ubuntu.com/security/CVE-2026-98432"},{"text":"The Go Security Team (golang-announce 29 Oct 2026, forwarded on oss-security 30 Oct 2026) says the demonstrated exploit requires an MPTCP listener but the bug is not specific to MPTCP, and advises GODEBUG=multipathtcp=0 for Go 1.24+ listen sockets, described by them as fragile.","headline":"Go team: bug is not MPTCP-specific; GODEBUG=multipathtcp=0 is fragile","section":"mitigations","date":"2026-10-30","sourceUrl":"http://www.openwall.com/lists/oss-security/2026/10/30/1"},{"text":"A public race-trigger, oracle and leak-analysis repository H1z3-br0/CVE-2026-98432 appeared on 30 Oct 2026. Its README says it is not a root exploit. Not indexed as a public PoC. Not reviewed by vuln2shell.","headline":"Public race-trigger and leak-analysis repo exists; README says it is not a root exploit","section":"pocs","date":"2026-10-30","sourceUrl":"https://github.com/H1z3-br0/CVE-2026-98432"}]},"whatTheBugIs":"CVE-2026-98432 is a use-after-free in the Linux kernel IPv4 TCP handshake path. The kernel CNA title is ipv4: free inet_opt and ireq_opt after an RCU grace period. The CVE Program record is PUBLISHED (reserved 25 Sep 2026, published 15 Oct 2026 12:08:22Z, record updated 30 Oct 2026 02:08:12Z). Kernel CNA CVSS 3.1 is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). NVD status on 30 Oct 2026 is Received, with no NVD analysis; NVD republishes only the CNA 9.8 metric. Red Hat, SUSE, Amazon Linux, and Oracle score it 8.1 (AC:H); Red Hat and Oracle mark that figure preliminary. Ubuntu shows CVSS 3.1 9.8 and CVSS 4.0 8.3, and Ubuntu priority High. Red Hat assigns CWE-825 Expired Pointer Dereference.\n\nThe CVE record and the fix do not mention MPTCP. Anthropic (27 Oct 2026) demonstrated remote root against a Linux server with a multipath TCP listener. The Go Security Team (golang-announce 29 Oct 2026, forwarded on oss-security 30 Oct 2026) says the demonstrated exploit requires an MPTCP listener but the bug is not specific to MPTCP, and that systems with no MPTCP listeners may be vulnerable to similar attacks. MPTCP is not a precondition of the bug.\n\nImpact is kernel memory corruption on the IPv4 TCP request-socket path (inet_opt / ireq_opt). The fix (Eric Dumazet, author date 1 Oct 2026; Reported-by Xinyang Ge of Anthropic; Reviewed-by Kuniyuki Iwashima; Signed-off-by Jakub Kicinski) switches those frees to kfree_rcu() in inet_sock_destruct() (net/ipv4/af_inet.c) and tcp_v4_reqsk_destructor() (net/ipv4/tcp_ipv4.c); two files, two insertions, two deletions. Commit e3f33b0a1d89d738e2b913dab519226eaf76e15b. Introducing commit: 079096f103faca2dd87342cca6f23d4b34da8871 (tcp/dccp: install syn_recv requests into ehash table; Eric Dumazet, 2 Oct 2015; first in 4.4). CNA: versions below 4.4 are unaffected. A second Fixes tag names c905dee62232 (tcp: Migrate TCP_NEW_SYN_RECV requests at retransmitting SYN+ACKs). IPv6 is not affected by the first issue (v6 duplicates the options). tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt (set only by CALIPSO); the commit says that will be addressed in a separate patch. Whether that follow-up exists: not verified.\n\nExploitation status: Anthropic published a proof of concept (Anthropic's wording) on 27 Oct 2026 (researcher demo, not in-the-wild use). No primary source reports in-the-wild exploitation as of 30 Oct 2026. Not in CISA KEV (catalog 2026.10.29, released 2026-10-29T19:09:34Z, 1,764 entries, checked 30 Oct 2026). A GitHub README (sgInnora/innora-cve-research, created 29 Oct 2026) claims Full chain verified; that claim is unverified and is not treated as fact.","attackPath":{"caption":"High-level only. Not a reproduction guide. Anthropic demonstrated root against a server with an MPTCP listener; the Go Security Team says the bug is not MPTCP-specific.","steps":[{"id":"reach","label":"Attacker on the network","detail":"Network-reachable IPv4 TCP listener. CNA vector: no credentials, no user interaction."},{"id":"app","label":"TCP SYN handling","detail":"Listening server handles IPv4 TCP SYN and SYN retransmission on the request-socket path."},{"id":"exploit","label":"Use-after-free","detail":"inet_opt / ireq_opt is freed with kfree while a retransmitted SYN builds a SYNACK. Conceptual class only."},{"id":"exec","label":"Kernel memory corruption","detail":"CNA: stale optlen or offsets in ip_options_build() can leak heap or write out of bounds."},{"id":"shell","label":"Root on the host","detail":"Anthropic proof of concept (Anthropic's wording): remote command as root on a server with an MPTCP listener. Not an in-the-wild report."}]},"exploitation":{"kev":{"listed":false,"date":"2026-10-29","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 30 Oct 2026) against catalog 2026.10.29 (released 2026-10-29T19:09:34.4003Z, 1,764 entries). CVE-2026-98432 is not listed."},"firstSeen":{"date":null,"source":"Anthropic Frontier Red Team (27 Oct 2026). Not an in-the-wild report.","note":"Anthropic published a proof of concept (Anthropic's wording) on 27 Oct 2026: a remote attacker sends packets to Linux servers with a multipath TCP listener and runs a chosen command as root, without credentials or user interaction. Researcher demo, not in-the-wild exploitation. No primary source reports in-the-wild use as of 30 Oct 2026. Aggregators (ismalicious.com updated 29 Oct 2026; osintsights 29 Oct 2026) report no confirmed exploitation; absence of evidence only. Not in CISA KEV (checked 30 Oct 2026).","dateLabel":"Proof of concept (Anthropic's wording)"},"vendorStatements":[{"vendor":"Linux kernel CNA","date":"2026-10-15","statement":"ipv4: free inet_opt and ireq_opt after an RCU grace period. CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Issue introduced in 4.4; versions below 4.4 are unaffected. Fixed in listed stable branches; update to the latest stable and do not cherry-pick.","url":"https://www.cve.org/CVERecord?id=CVE-2026-98432","retracted":false},{"vendor":"Anthropic Frontier Red Team","date":"2026-10-27","statement":"Claude wrote an exploit that allows a remote attacker to send packets to Linux servers with a multipath TCP listener to run arbitrary commands as root, without any credentials or user interaction. Proof of concept (Anthropic's wording). The post does not release exploit code.","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","retracted":false},{"vendor":"Go Security Team","date":"2026-10-29","statement":"The demonstrated exploit requires an MPTCP listener but the bug is not specific to MPTCP. It is possible that systems with no MPTCP listeners are vulnerable to similar attacks. As of Go 1.24, Go programs enable MPTCP by default for listen sockets on Linux. Opt out with GODEBUG=multipathtcp=0 (described as fragile). Per-socket SetMultipathTCP calls override GODEBUG.","url":"http://www.openwall.com/lists/oss-security/2026/10/30/1","retracted":false},{"vendor":"Red Hat","date":"2026-10-15","statement":"CVSS 8.1 preliminary (AV:N/AC:H). RHEL 8, 9, 10 kernel Affected (no fix shipped as of the page). RHEL 6 and 7 Not affected. Mitigation not available or do not meet Red Hat Product Security criteria.","url":"https://access.redhat.com/security/cve/CVE-2026-98432","retracted":false}]},"timeline":[{"date":"2015-10-02","event":"Introducing commit 079096f103faca2dd87342cca6f23d4b34da8871 (tcp/dccp: install syn_recv requests into ehash table, Eric Dumazet) lands; first in Linux 4.4. The CNA record's scope starts here.","source":{"title":"079096f1 tcp/dccp: install syn_recv requests into ehash table","url":"https://github.com/torvalds/linux/commit/079096f103faca2dd87342cca6f23d4b34da8871","publisher":"Linux kernel (GitHub mirror)"},"kind":"other","addedDate":"2026-10-30"},{"date":"2026-09-25","event":"CVE-2026-98432 reserved.","source":{"title":"CVE-2026-98432","url":"https://www.cve.org/CVERecord?id=CVE-2026-98432","publisher":"CVE Program"},"kind":"disclosure","addedDate":"2026-10-30"},{"date":"2026-10-01","event":"Eric Dumazet fix e3f33b0a1d89d738e2b913dab519226eaf76e15b switches inet_opt / ireq_opt frees to kfree_rcu(). Reported-by Xinyang Ge (Anthropic). Second Fixes tag: c905dee62232 (request-socket migration path).","source":{"title":"e3f33b0a ipv4: free inet_opt and ireq_opt after an RCU grace period","url":"https://github.com/torvalds/linux/commit/e3f33b0a1d89d738e2b913dab519226eaf76e15b","publisher":"Linux kernel (GitHub mirror)"},"kind":"patch","key":true,"addedDate":"2026-10-30"},{"date":"2026-10-15T12:08:22Z","event":"CVE-2026-98432 published. Kernel CNA (Greg Kroah-Hartman, linux-cve-announce) lists fixed stable versions and CVSS 3.1 9.8.","source":{"title":"linux-cve-announce CVE-2026-98432","url":"https://lists.openwall.net/linux-cve-announce/2026/10/15/1","publisher":"Linux kernel CNA (openwall mirror)"},"kind":"advisory","key":true,"addedDate":"2026-10-30"},{"date":"2026-10-15T13:17:13Z","event":"NVD published CVE-2026-98432. Status when opened on 30 Oct 2026: Received (no NVD analysis). CNA 9.8 metric is present.","source":{"title":"NVD - CVE-2026-98432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98432","publisher":"NVD"},"kind":"disclosure","addedDate":"2026-10-30"},{"date":"2026-10-16","event":"Oracle published UEK errata ELSA-2026-500397 (OL7/OL8), ELSA-2026-500398 (OL8/OL9), and ELSA-2026-500399 (OL9/OL10). RHCK status is not on the Oracle CVE page.","source":{"title":"Oracle Linux CVE-2026-98432","url":"https://linux.oracle.com/cve/CVE-2026-98432.html","publisher":"Oracle"},"kind":"vendor","addedDate":"2026-10-30"},{"date":"2026-10-24","event":"Amazon Linux 2023 kernel6.18 fixed (ALAS2023-2026-3251).","source":{"title":"Amazon Linux CVE-2026-98432","url":"https://explore.alas.aws.amazon.com/CVE-2026-98432.html","publisher":"Amazon Linux"},"kind":"patch","addedDate":"2026-10-30"},{"date":"2026-10-27","event":"Anthropic Frontier Red Team published a proof of concept (Anthropic's wording) of remote root against Linux servers with a multipath TCP listener. Researcher demo, not an in-the-wild report. No exploit code in the post.","source":{"title":"Discovering and exploiting vulnerabilities in critical, real-world software with Claude","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","publisher":"Anthropic"},"kind":"reported","key":true,"addedDate":"2026-10-30"},{"date":"2026-10-29","event":"SUSE (most LTSS) and Amazon Linux 2023 kernel6.12 shipped fixes. Ubuntu linux packages still Vulnerable or work in progress. RHEL 8/9/10 still Affected with no fix shipped.","source":{"title":"SUSE CVE-2026-98432","url":"https://www.suse.com/security/cve/CVE-2026-98432.html","publisher":"SUSE"},"kind":"vendor","key":true,"addedDate":"2026-10-30"},{"date":"2026-10-30","event":"Debian security tracker (checked 30 Oct 2026) lists bookworm, trixie, forky, and sid linux packages as fixed (DSA-6568-1, DLA-4841-1, DLA-4850-1).","source":{"title":"Debian security tracker CVE-2026-98432","url":"https://security-tracker.debian.org/tracker/CVE-2026-98432","publisher":"Debian"},"kind":"vendor","addedDate":"2026-10-30"},{"date":"2026-10-29T16:34:28-07:00","event":"Go Security Team (Neal Patel, 29 Oct 2026 16:34:28 PDT) says the bug is not specific to MPTCP and advises GODEBUG=multipathtcp=0 for Go 1.24+ listen sockets, described as fragile. Per-socket SetMultipathTCP calls override GODEBUG. Forwarded by Alan Coopersmith on oss-security on 30 Oct 2026.","source":{"title":"oss-security: Go Security Team note on CVE-2026-98432","url":"http://www.openwall.com/lists/oss-security/2026/10/30/1","publisher":"Go Security Team via oss-security"},"kind":"advisory","key":true,"addedDate":"2026-10-30"},{"date":"2026-10-29T08:09:38Z","event":"sgInnora/innora-cve-research README table claims Full chain verified for CVE-2026-98432 and says a complete weaponized exploit will not be made public in the short term. Unverified third-party claim. Not indexed as a PoC.","source":{"title":"sgInnora/innora-cve-research","url":"https://github.com/sgInnora/innora-cve-research","publisher":"sgInnora (unverified)"},"kind":"reported","addedDate":"2026-10-30"},{"date":"2026-10-29T19:09:34Z","event":"CISA KEV catalog 2026.10.29 released (1,764 entries). CVE-2026-98432 is not listed. Rechecked 30 Oct 2026.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","addedDate":"2026-10-30"},{"date":"2026-10-30T00:22:53Z","event":"H1z3-br0/CVE-2026-98432 published. README: race trigger with a heap-reuse oracle; not a one-click root exploit; stage 3 described but not implemented. Code not reviewed by vuln2shell.","source":{"title":"H1z3-br0/CVE-2026-98432","url":"https://github.com/H1z3-br0/CVE-2026-98432","publisher":"H1z3-br0"},"kind":"poc","addedDate":"2026-10-30"}],"openNotes":[{"title":"MPTCP is not a precondition of the bug","detail":"The CVE record and the fix never mention MPTCP. Anthropic's 27 Oct 2026 post says the proof of concept (Anthropic's wording) worked against Linux servers with a multipath TCP listener and does not say why MPTCP is needed, nor whether non-MPTCP servers are exploitable. The Go Security Team says the bug is not specific to MPTCP. MPTCP is not a precondition of the bug.","sources":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98432","date":"2026-10-15","publisher":"CVE Program"},{"url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","date":"2026-10-27","publisher":"Anthropic"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/1","date":"2026-10-30","publisher":"Go Security Team via oss-security"}]},{"title":"H1z3-br0 race-trigger and leak-analysis repo is not a root exploit","detail":"H1z3-br0/CVE-2026-98432 (created 30 Oct 2026 00:22:53Z) is a public race-trigger, oracle and leak-analysis repository. Its README says it is not a one-click root exploit and that stage 3 is described but not implemented. Not indexed as a public PoC. Not reviewed by vuln2shell. This site does not copy any code.","sources":[{"url":"https://github.com/H1z3-br0/CVE-2026-98432","date":"2026-10-30","publisher":"H1z3-br0"}]},{"title":"sgInnora Full chain verified claim is unverified","detail":"The sgInnora/innora-cve-research README (created 29 Oct 2026) claims Full chain verified and says a complete weaponized exploit will not be made public in the short term. No primary source confirms that claim. The poc directory was not opened. Not indexed under PoCs.","sources":[{"url":"https://github.com/sgInnora/innora-cve-research","date":"2026-10-29","publisher":"sgInnora (unverified)"}]},{"title":"Several commit pages and trackers were not verified","detail":"Fix and introducing commit text was read via GitHub mirrors (torvalds/linux e3f33b0a and 079096f1; gregkh/linux b3b027ef). The other five stable commit bodies were not read. git.kernel.org and lore.kernel.org were not verified (bot challenge / HTTP 403). go.dev/issue/82717 timed out (not verified). Azure Linux, Alpine, Arch, AlmaLinux, and Rocky own trackers: no statement found or not verified. FIRST EPSS was queried on 30 Oct 2026 (score 0.00388, percentile 0.32813, date 2026-10-29).","sources":[{"url":"https://github.com/torvalds/linux/commit/e3f33b0a1d89d738e2b913dab519226eaf76e15b","date":"2026-10-01","publisher":"Linux kernel (GitHub mirror)"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98432","date":"2026-10-30","publisher":"NVD"}]},{"title":"IPv6 / CALIPSO follow-up patch: not verified","detail":"The fix commit says IPv6 is not affected by the first issue and that tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt (set only by CALIPSO), to be addressed in a separate patch. Whether that patch exists: not verified.","sources":[{"url":"https://github.com/torvalds/linux/commit/e3f33b0a1d89d738e2b913dab519226eaf76e15b","date":"2026-10-01","publisher":"Linux kernel (GitHub mirror)"}]}],"defenderActions":[{"title":"Inventory running kernels and MPTCP listeners","detail":"Record uname -r against the CNA stable table and your vendor's fixed package. Distro kernels backport with old-looking version numbers, so check the vendor package, not only the upstream number. List MPTCP listeners with ss -lnMp. As of Go 1.24, Go programs enable MPTCP by default for listen sockets on Linux (Go Security Team).","priority":"now","links":[{"label":"CNA announce (openwall mirror)","href":"https://lists.openwall.net/linux-cve-announce/2026/10/15/1"},{"label":"Go Security Team via oss-security","href":"http://www.openwall.com/lists/oss-security/2026/10/30/1"}]},{"title":"Patch to a fixed kernel and reboot","detail":"The CNA recommends the latest stable and says not to cherry-pick. Debian, SUSE (most LTSS), Oracle UEK, and parts of Amazon Linux 2023 have shipped fixes. Ubuntu and RHEL had not as of the pages read on 30 Oct 2026. Livepatch only where the vendor ships one.","priority":"now","links":[{"label":"Debian tracker","href":"https://security-tracker.debian.org/tracker/CVE-2026-98432"},{"label":"Ubuntu CVE page","href":"https://ubuntu.com/security/CVE-2026-98432"},{"label":"Red Hat CVE page","href":"https://access.redhat.com/security/cve/CVE-2026-98432"}]},{"title":"If you cannot patch yet: Go opt-out, then treat other steps as leads","detail":"Red Hat says no mitigation meets its Product Security criteria. For Go 1.24+ services, set GODEBUG=multipathtcp=0 or godebug multipathtcp=0 in go.mod (Go Security Team; they call this fragile). Per-socket SetMultipathTCP calls override GODEBUG. net.mptcp.enabled=0 is a third-party suggestion only: it does not close MPTCP listeners that are already open, and it does not address the underlying non-MPTCP bug.","priority":"now","links":[{"label":"Go Security Team via oss-security","href":"http://www.openwall.com/lists/oss-security/2026/10/30/1"},{"label":"Red Hat CVE page","href":"https://access.redhat.com/security/cve/CVE-2026-98432"}]},{"title":"Hunt kernel logs and packet captures; do not invent an auditd rule","detail":"On KASAN-enabled or crashed hosts, look in dmesg / journald for skb_under_panic or KASAN reports that name ip_options_build. Anthropic says a lost race only fails the handshake without crashing, so absence of crashes proves nothing. Seeing the attack needs packet capture of IPv4 TCP SYNs that carry IP options. No sourced auditd rule exists.","priority":"soon","links":[{"label":"CVE record (CNA scenario)","href":"https://www.cve.org/CVERecord?id=CVE-2026-98432"}]}],"detection":[{"title":"MPTCP listeners on the host (ss -lnMp)","detail":"ss -lnMp lists MPTCP sockets (the -M flag). Used in getrff.com and suriq.io writeups (secondary). Kernel default net.mptcp.enabled is 1 (enabled) per upstream docs. Presence of a listener is inventory, not proof of exploitation. Anthropic's lab target was a server with an MPTCP listener; the Go team says the bug is not MPTCP-specific.","logSource":"Host shell (ss / sysctl)","kind":"generic","url":"https://docs.kernel.org/networking/mptcp-sysctl.html","date":"2026-10-30","dateKind":"checked"},{"title":"Running kernel versus a fixed package (uname -r)","detail":"Compare uname -r to the CNA stable table and your vendor's fixed package. Distro kernels backport with old-looking numbers. Branches with no CNA fixed version are not unaffected; say no CNA fix listed.","logSource":"Host inventory (uname)","kind":"generic","url":"https://kernel.googlesource.com/pub/scm/linux/security/vulns/+/refs/heads/master/cve/published/2026/CVE-2026-98432.mbox","date":"2026-10-15"},{"title":"Kernel oops: skb_under_panic or KASAN in ip_options_build","detail":"The CNA scenario text says a reclaimed optlen can trigger skb_under_panic. The fix commit names a use-after-free in ip_options_build(). Search dmesg, journald (kernel), serial, or kdump. Anthropic says a lost race only fails the handshake without crashing the system, so absence of crashes proves nothing.","logSource":"dmesg / journald (kernel) or serial/kdump","kind":"generic","url":"https://www.cve.org/CVERecord?id=CVE-2026-98432","date":"2026-10-15"},{"title":"Packet capture of IPv4 TCP SYNs with IP options","detail":"Derived from the CNA text: inbound IPv4 TCP SYNs carrying Record Route or Timestamp options, plus retransmitted SYNs to a listener; SYN-ACKs that are longer than expected. Ordinary NetFlow or auditd will not see IP options. Needs packet capture / NDR / IDS (pcap). The H1z3-br0 README says that repo ships Suricata rules; those rules were not opened or validated here.","logSource":"Packet capture / NDR / IDS (pcap)","kind":"generic","url":"https://www.cve.org/CVERecord?id=CVE-2026-98432","date":"2026-10-15"},{"title":"No sourced auditd rule","detail":"No sourced auditd rule exists for this bug. Do not invent one. Treat missing auditd hits as no statement yet, not as clearance.","logSource":"auditd","kind":"generic","url":"https://www.cve.org/CVERecord?id=CVE-2026-98432","date":"2026-10-30","dateKind":"checked"}],"detectionLinks":[{"title":"fbuff-tools/cve-2026-98432-checker (community, unreviewed)","url":"https://github.com/fbuff-tools/cve-2026-98432-checker","author":"fbuff-tools","date":"2026-10-30","note":"Unofficial read-only checker found in GitHub search. Not run or reviewed."},{"title":"Quaerendir/cve-2026-98432-audit (community, unreviewed)","url":"https://github.com/Quaerendir/cve-2026-98432-audit","author":"Quaerendir","date":"2026-10-30","note":"Unofficial read-only checker. Not run or reviewed."},{"title":"maxigentr/netviser-linux-security-auditor (community, unreviewed)","url":"https://github.com/maxigentr/netviser-linux-security-auditor","author":"maxigentr","date":"2026-10-30","note":"Unofficial checker. Not run or reviewed."},{"title":"axisops/CVE-2026-98432 Ansible role (community, unreviewed)","url":"https://github.com/axisops/CVE-2026-98432","author":"axisops","date":"2026-10-30","note":"Ansible mitigation role. Not run or reviewed. Not a vendor workaround."},{"title":"mahdi-salmanzade/CVE-2026-98432 (community, unreviewed)","url":"https://github.com/mahdi-salmanzade/CVE-2026-98432","author":"mahdi-salmanzade","date":"2026-10-30","note":"Unofficial checker. Not run or reviewed."},{"title":"H1z3-br0 README mentions Suricata rules (not opened)","url":"https://github.com/H1z3-br0/CVE-2026-98432","author":"H1z3-br0","date":"2026-10-30","note":"README says the repo ships Suricata rules. Rule content was not opened or validated. Not copied here."}],"amIAffected":{"summary":"CNA scope starts at Linux 4.4; versions below 4.4 are unaffected. Upstream stables 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.2, and mainline 7.3 have listed fixes. Debian, some SUSE trains, Oracle UEK, and parts of Amazon Linux 2023 have shipped packages. Ubuntu (priority High) and RHEL 8/9/10 had not as of 30 Oct 2026. RHEL 6/7, Ubuntu 14.04, and SLES 11 SP4 LTSS EXTREME CORE are vendor-stated not affected. Alma, Rocky, Alpine, Arch, Azure Linux, and Oracle RHCK: no statement yet.","checks":[{"id":"v2s-aia-linux-kernel-tcp-uaf-cve-2026-98432-version-1","kind":"version","title":"Record uname -r against the CNA table and your vendor package","detail":"CNA Fixed in: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, mainline 7.3. Distro kernels backport with old-looking numbers. Check the vendor's fixed package, not only the upstream number.","command":"uname -r","affectedMeans":"The running kernel is 4.4 or later and is below the CNA or vendor fixed package for that train.","fixedMeans":"The running kernel matches a CNA Fixed in version or a vendor package the vendor marks fixed, or the vendor states this train is not affected (versions below 4.4 per CNA; RHEL 6/7, Ubuntu 14.04, SLES 11 SP4 LTSS EXTREME CORE).","notes":"Inventory only. Do not send crafted SYNs to test the path. Branches with no CNA Fixed in line are not unaffected.","sources":[{"url":"https://kernel.googlesource.com/pub/scm/linux/security/vulns/+/refs/heads/master/cve/published/2026/CVE-2026-98432.mbox","date":"2026-10-15","publisher":"Linux kernel CNA"}]},{"id":"v2s-aia-linux-kernel-tcp-uaf-cve-2026-98432-package-2","kind":"package","title":"Record the distro kernel package against that distro's tracker","detail":"Debian, Ubuntu, Red Hat, SUSE, Amazon Linux, and Oracle publish their own rows. Ubuntu and RHEL 8/9/10 had no shipped fix on the pages read 30 Oct 2026. Alma, Rocky, Alpine, Arch, and Azure Linux: no statement yet.","command":"Record the installed kernel package from the distro package manager (for example dpkg -l linux-image-* or rpm -q kernel) and compare it to that distro's CVE-2026-98432 tracker row.","affectedMeans":"The installed package is listed Vulnerable, Affected, Pending Fix, or work in progress on the vendor tracker.","fixedMeans":"The installed package is listed fixed on the vendor tracker, or the vendor states this train is not affected.","notes":"Do not treat an Alma, Rocky, Alpine, Arch, or Azure Linux host as not affected. Those trackers had no statement found or were not verified.","sources":[{"url":"https://security-tracker.debian.org/tracker/CVE-2026-98432","date":"2026-10-30","publisher":"Debian"},{"url":"https://ubuntu.com/security/CVE-2026-98432","date":"2026-10-29","publisher":"Ubuntu"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98432","date":"2026-10-15","publisher":"Red Hat"}]},{"id":"v2s-aia-linux-kernel-tcp-uaf-cve-2026-98432-config-3","kind":"config","title":"Record MPTCP listeners and net.mptcp.enabled","detail":"ss -lnMp lists MPTCP sockets. sysctl net.mptcp.enabled reads the per-namespace sysctl (upstream default 1). Anthropic's lab target was a server with an MPTCP listener. The Go team says the bug is not MPTCP-specific. Presence of a listener is inventory, not proof of exploitation.","command":"ss -lnMp; sysctl net.mptcp.enabled","affectedMeans":"An MPTCP listener is present, or net.mptcp.enabled is 1, on a kernel that is still in an affected range.","fixedMeans":"The kernel is on a fixed package. An empty ss -lnMp result does not clear a host: the Go team says systems with no MPTCP listeners may still be vulnerable to similar attacks.","notes":"Needs host shell access. Do not send crafted SYNs. Restarted services can reopen listeners after a sysctl change.","sources":[{"url":"https://docs.kernel.org/networking/mptcp-sysctl.html","date":"2026-10-30","publisher":"Linux kernel docs"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/1","date":"2026-10-30","publisher":"Go Security Team via oss-security"}]},{"id":"v2s-aia-linux-kernel-tcp-uaf-cve-2026-98432-config-4","kind":"config","title":"Record Go 1.24+ listen-socket MPTCP and GODEBUG","detail":"Go Security Team: as of Go 1.24, Go programs enable MPTCP by default for listen sockets on Linux. Opt out with GODEBUG=multipathtcp=0 or godebug multipathtcp=0 in go.mod, or per-socket net.ListenConfig.SetMultipathTCP. Per-socket SetMultipathTCP calls override GODEBUG. They describe the opt-out as fragile. go.dev/issue/82717 was not verified (fetch timed out).","command":"On each Go service host, record the Go version and whether GODEBUG=multipathtcp=0 or a go.mod godebug multipathtcp=0 is set. Then re-check ss -lnMp after restart.","affectedMeans":"A Go 1.24 or later service is listening and neither GODEBUG=multipathtcp=0 nor the go.mod godebug is set, or a per-socket SetMultipathTCP call re-enables MPTCP, on an affected kernel.","fixedMeans":"The kernel is patched, or every Go 1.24+ service has the opt-out and no MPTCP listener remains after restart. The opt-out does not fix the non-MPTCP path.","notes":"No primary source was found for other software that opens MPTCP listeners by default.","sources":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/1","date":"2026-10-30","publisher":"Go Security Team via oss-security"}]},{"id":"v2s-aia-linux-kernel-tcp-uaf-cve-2026-98432-config-5","kind":"config","title":"Record request-socket migration (tcp_migrate_req / BPF reuseport)","detail":"The fix commit names a second path: net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program shares ireq_opt. The sysctl default is not stated in the primary sources we opened.","command":"sysctl net.ipv4.tcp_migrate_req; record whether a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is attached.","affectedMeans":"tcp_migrate_req is 1, or a migrate BPF program is attached, on an affected kernel.","fixedMeans":"The kernel is patched, or migration is off and no migrate BPF program is attached. Turning migration off does not fix the main SYNACK path.","notes":"suriq.io says the sysctl is off by default (secondary). Primary sources do not state the default.","sources":[{"url":"https://github.com/torvalds/linux/commit/e3f33b0a1d89d738e2b913dab519226eaf76e15b","date":"2026-10-01","publisher":"Linux kernel (GitHub mirror)"}]}],"limits":["No sourced Shodan or Censys fingerprint. Do not invent one.","No Nuclei check was found (projectdiscovery path returned 404; ismalicious.com said none so far on 29 Oct 2026).","AlmaLinux, Rocky, Alpine, Arch, and Azure Linux: no statement yet or not verified.","Absence of MPTCP listeners does not clear a host (Go Security Team)."],"sources":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98432","date":"2026-10-15","publisher":"CVE Program"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/1","date":"2026-10-30","publisher":"Go Security Team via oss-security"}],"updatedAt":"2026-10-30","addedDate":"2026-10-30"},"mitigations":{"summary":"Red Hat says no mitigation meets its Product Security criteria. The software fix is a patched kernel plus reboot. Sourced interim steps: GODEBUG=multipathtcp=0 for Go 1.24+ services (Go Security Team; they call this fragile). net.mptcp.enabled=0 is a third-party suggestion only, with the caveats below.","items":[{"title":"Go 1.24+ services: GODEBUG=multipathtcp=0","detail":"Go Security Team: as of Go 1.24, Go programs enable MPTCP by default for listen sockets on Linux. Opt out with GODEBUG=multipathtcp=0 or godebug multipathtcp=0 in go.mod. Per-socket SetMultipathTCP calls override GODEBUG, so a service that calls SetMultipathTCP(true) still opens an MPTCP listener. Restart the service and re-check ss -lnMp.","limits":"The Go team describes this opt-out as fragile. Per-socket SetMultipathTCP calls override GODEBUG. It does not patch the kernel. The same note says the bug is not specific to MPTCP, so hosts with no MPTCP listeners may still be vulnerable to similar attacks. Not a Red Hat or kernel CNA workaround.","verify":"Each Go 1.24+ service has GODEBUG=multipathtcp=0 or the go.mod godebug set, does not re-enable MPTCP via SetMultipathTCP, has been restarted, and ss -lnMp no longer shows that service. Re-check after the next deploy.","source":{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/1","date":"2026-10-30","publisher":"Go Security Team via oss-security"}},{"title":"net.mptcp.enabled=0 (third-party suggestion; leads only)","detail":"Upstream docs: net.mptcp.enabled controls whether MPTCP sockets can be created (default 1). Third-party writeups recommend setting it to 0. No primary source (vendor, kernel CNA, or Anthropic) recommends it as a mitigation.","limits":"Third-party suggestion only. Authors caution that it does not close MPTCP listeners that are already open (restart those services and re-check ss -lnMp), and that it does not address the underlying non-MPTCP bug. Not vendor-endorsed. Red Hat says no mitigation meets its bar.","verify":"sysctl net.mptcp.enabled is 0, MPTCP-using services have been restarted, and ss -lnMp is empty for those hosts. This check does not prove the IPv4 TCP path is closed.","source":{"url":"https://docs.kernel.org/networking/mptcp-sysctl.html","date":"2026-10-30","publisher":"Linux kernel docs (sysctl semantic only; mitigation recommendation is third-party)"}}],"updatedAt":"2026-10-30","addedDate":"2026-10-30"},"response":{"summary":"Patch to a fixed kernel and reboot. Red Hat says no mitigation meets its bar. If a host was reachable while vulnerable, preserve uname -r, ss -lnMp output, dmesg/journald, and any packet captures. No sourced in-the-wild persistence list exists. Anthropic's 27 Oct 2026 write-up is a proof of concept (Anthropic's wording), not an incident report.","containment":[{"title":"Patch to a fixed kernel and reboot","detail":"CNA: update to the latest stable; do not cherry-pick. Use the vendor package where one exists. An upgrade does not replace review of logs from the vulnerable period.","sources":[{"url":"https://lists.openwall.net/linux-cve-announce/2026/10/15/1","date":"2026-10-15","publisher":"Linux kernel CNA"}]},{"title":"If you cannot patch yet, apply the Go opt-out on Go 1.24+ services","detail":"Go Security Team: GODEBUG=multipathtcp=0 or godebug multipathtcp=0 in go.mod. They call this fragile. Restart and re-check ss -lnMp. Red Hat: no mitigation meets its criteria.","sources":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/1","date":"2026-10-30","publisher":"Go Security Team via oss-security"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98432","date":"2026-10-15","publisher":"Red Hat"}]}],"rotate":[{"item":"Host credentials, keys, and secrets the root user could reach","reason":"General: if command execution as root succeeded, treat secrets on or behind that host as exposed. Anthropic's proof of concept (Anthropic's wording) ends in an attacker-chosen shell command as root. No CVE-2026-98432-specific rotate list was published in the sources we opened.","generic":true,"sources":[{"url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","date":"2026-10-27","publisher":"Anthropic"}]}],"evidence":[{"title":"uname -r and vendor kernel package from before the upgrade","detail":"Preserve the version you recorded against the CNA table and the vendor tracker so you can show whether the host was in an affected range.","sources":[{"url":"https://kernel.googlesource.com/pub/scm/linux/security/vulns/+/refs/heads/master/cve/published/2026/CVE-2026-98432.mbox","date":"2026-10-15","publisher":"Linux kernel CNA"}]},{"title":"ss -lnMp and sysctl net.mptcp.enabled from the vulnerable period","detail":"Keep a record of MPTCP listeners and the sysctl value. An empty listener list is not clearance.","sources":[{"url":"https://docs.kernel.org/networking/mptcp-sysctl.html","date":"2026-10-30","publisher":"Linux kernel docs"}]},{"title":"dmesg / journald (kernel) and any serial or kdump from the period","detail":"Keep skb_under_panic or KASAN lines that name ip_options_build. Anthropic says a lost race only fails the handshake without crashing, so absence of crashes proves nothing.","sources":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98432","date":"2026-10-15","publisher":"CVE Program"}]},{"title":"Packet captures of IPv4 TCP SYNs that carry IP options","detail":"Ordinary NetFlow and auditd will not see IP options. Keep pcaps if you have them. No sourced network IOC list exists.","sources":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98432","date":"2026-10-15","publisher":"CVE Program"}]}],"limits":["No sourced in-the-wild persistence paths or IOCs from a source we opened.","Anthropic 27 Oct 2026 is a proof of concept (Anthropic's wording), not an incident report.","No sourced auditd rule. Absence of crashes or audit hits is no statement yet.","Not in CISA KEV (catalog 2026.10.29, checked 30 Oct 2026). No known ITW."],"sources":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98432","date":"2026-10-15","publisher":"CVE Program"},{"url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","date":"2026-10-27","publisher":"Anthropic"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/30/1","date":"2026-10-30","publisher":"Go Security Team via oss-security"}],"updatedAt":"2026-10-30","addedDate":"2026-10-30"},"bulletins":[{"vendor":"Linux kernel CNA","title":"linux-cve-announce CVE-2026-98432","url":"https://lists.openwall.net/linux-cve-announce/2026/10/15/1","date":"2026-10-15","cve":"CVE-2026-98432"},{"vendor":"Debian","title":"Debian security tracker CVE-2026-98432 (DSA-6568-1, DLA-4841-1, DLA-4850-1)","url":"https://security-tracker.debian.org/tracker/CVE-2026-98432","date":"2026-10-30","cve":"CVE-2026-98432","dateKind":"checked"},{"vendor":"Ubuntu","title":"Ubuntu CVE-2026-98432 (priority High; no USN listed)","url":"https://ubuntu.com/security/CVE-2026-98432","date":"2026-10-29","cve":"CVE-2026-98432"},{"vendor":"Red Hat","title":"Red Hat CVE-2026-98432","url":"https://access.redhat.com/security/cve/CVE-2026-98432","date":"2026-10-15","cve":"CVE-2026-98432"},{"vendor":"SUSE","title":"SUSE CVE-2026-98432 (SUSE-SU-2026:24386-1, SUSE-SU-2026:24422-1)","url":"https://www.suse.com/security/cve/CVE-2026-98432.html","date":"2026-10-29","cve":"CVE-2026-98432"},{"vendor":"Amazon Linux","title":"Amazon Linux CVE-2026-98432 (ALAS2023-2026-3251, ALAS2023-2026-3335)","url":"https://explore.alas.aws.amazon.com/CVE-2026-98432.html","date":"2026-10-29","cve":"CVE-2026-98432"},{"vendor":"Oracle","title":"Oracle Linux CVE-2026-98432 (ELSA-2026-500397/398/399)","url":"https://linux.oracle.com/cve/CVE-2026-98432.html","date":"2026-10-15","cve":"CVE-2026-98432"}],"coverage":[{"title":"CVE-2026-98432 record","publisher":"CVE Program","url":"https://www.cve.org/CVERecord?id=CVE-2026-98432","date":"2026-10-15","type":"vendor","addedDate":"2026-10-30"},{"title":"linux-cve-announce CVE-2026-98432 (openwall mirror)","publisher":"Linux kernel CNA","url":"https://lists.openwall.net/linux-cve-announce/2026/10/15/1","date":"2026-10-15","type":"vendor","addedDate":"2026-10-30"},{"title":"CNA mbox on kernel.googlesource.com","publisher":"Linux kernel CNA","url":"https://kernel.googlesource.com/pub/scm/linux/security/vulns/+/refs/heads/master/cve/published/2026/CVE-2026-98432.mbox","date":"2026-10-15","type":"vendor","addedDate":"2026-10-30"},{"title":"NVD CVE-2026-98432 (status Received)","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98432","date":"2026-10-15","type":"government","addedDate":"2026-10-30"},{"title":"CISA KEV catalog JSON (CVE-2026-98432 not listed; catalog 2026.10.29)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-10-29","type":"government","addedDate":"2026-10-30"},{"title":"Debian security tracker CVE-2026-98432","publisher":"Debian","url":"https://security-tracker.debian.org/tracker/CVE-2026-98432","date":"2026-10-30","type":"vendor","addedDate":"2026-10-30"},{"title":"Ubuntu CVE-2026-98432","publisher":"Ubuntu","url":"https://ubuntu.com/security/CVE-2026-98432","date":"2026-10-29","type":"vendor","addedDate":"2026-10-30"},{"title":"Red Hat CVE-2026-98432","publisher":"Red Hat","url":"https://access.redhat.com/security/cve/CVE-2026-98432","date":"2026-10-15","type":"vendor","addedDate":"2026-10-30"},{"title":"SUSE CVE-2026-98432","publisher":"SUSE","url":"https://www.suse.com/security/cve/CVE-2026-98432.html","date":"2026-10-29","type":"vendor","addedDate":"2026-10-30"},{"title":"Amazon Linux CVE-2026-98432","publisher":"Amazon Linux","url":"https://explore.alas.aws.amazon.com/CVE-2026-98432.html","date":"2026-10-29","type":"vendor","addedDate":"2026-10-30"},{"title":"Oracle Linux CVE-2026-98432","publisher":"Oracle","url":"https://linux.oracle.com/cve/CVE-2026-98432.html","date":"2026-10-15","type":"vendor","addedDate":"2026-10-30"},{"title":"Blocking IPv4 TCP options for CVE-2026-98432 (secondary)","publisher":"getrff.com","url":"https://getrff.com/blog/cve-2026-98432-linux-tcp-ip-options-block/","date":"2026-10-30","type":"news","addedDate":"2026-10-30"},{"title":"Linux kernel CVE-2026-98432 TCP / MPTCP remote root (secondary)","publisher":"suriq.io","url":"https://suriq.io/blog/linux-kernel-cve-2026-98432-tcp-mptcp-remote-root","date":"2026-10-30","type":"news","addedDate":"2026-10-30"},{"title":"Critical Linux kernel TCP flaw CVE-2026-98432 (secondary)","publisher":"Redside Security","url":"https://blog.redsidesecurity.com/post/critical-linux-kernel-tcp-flaw-cve-2026-98432-rated-9-8-exploit-written-by-ai-model","date":"2026-10-30","type":"news","addedDate":"2026-10-30"},{"title":"Linux flaw exposes servers to remote code execution (secondary)","publisher":"OSINTSights","url":"https://osintsights.com/linux-flaw-exposes-servers-to-remote-code-execution","date":"2026-10-29","type":"news","addedDate":"2026-10-30"}],"posts":[],"research":[{"title":"Discovering and exploiting vulnerabilities in critical, real-world software with Claude","url":"https://www.anthropic.com/research/discovering-vulnerabilities-with-claude","authors":"Anthropic Frontier Red Team (reporter credit on the fix: Xinyang Ge)","date":"27 Oct 2026"},{"title":"e3f33b0a ipv4: free inet_opt and ireq_opt after an RCU grace period","url":"https://github.com/torvalds/linux/commit/e3f33b0a1d89d738e2b913dab519226eaf76e15b","authors":"Eric Dumazet (Reviewed-by Kuniyuki Iwashima; Signed-off-by Jakub Kicinski; Reported-by Xinyang Ge)","date":"1 Oct 2026"},{"title":"Go Security Team note, forwarded on oss-security","url":"http://www.openwall.com/lists/oss-security/2026/10/30/1","authors":"Go Security Team (Neal Patel); forwarded by Alan Coopersmith","date":"29 Oct 2026 / 30 Oct 2026"},{"title":"linux-cve-announce CVE-2026-98432","url":"https://lists.openwall.net/linux-cve-announce/2026/10/15/1","authors":"Greg Kroah-Hartman, Linux kernel CNA","date":"15 Oct 2026"},{"title":"CISA KEV catalog JSON (CVE-2026-98432 not listed; catalog 2026.10.29)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","authors":"CISA","date":"catalog 2026.10.29, checked 30 Oct 2026"}],"impact":{"kind":"single-product","product":"Linux kernel","versions":[{"version":"Linux 5.10 stable (upstream)","status":"affected","versions":"5.10: >= 5.10.272","vendorStatement":{"date":"2026-10-15","url":"https://kernel.googlesource.com/pub/scm/linux/security/vulns/+/refs/heads/master/cve/published/2026/CVE-2026-98432.mbox","quote":"Fixed in 5.10.272 (b3b027ef0cd322bfa839b9aaf5b27551eea54cf6)"},"addedDate":"2026-10-30"},{"version":"Linux 5.15 stable (upstream)","status":"affected","versions":"5.15: >= 5.15.223","vendorStatement":{"date":"2026-10-15","url":"https://kernel.googlesource.com/pub/scm/linux/security/vulns/+/refs/heads/master/cve/published/2026/CVE-2026-98432.mbox","quote":"Fixed in 5.15.223 (95a8c8fa9f27dce64c40c41c062de7728bf34ab5)"},"addedDate":"2026-10-30"},{"version":"Linux 6.1 stable (upstream)","status":"affected","versions":"6.1: >= 6.1.190","vendorStatement":{"date":"2026-10-15","url":"https://kernel.googlesource.com/pub/scm/linux/security/vulns/+/refs/heads/master/cve/published/2026/CVE-2026-98432.mbox","quote":"Fixed in 6.1.190 (89b5b1eb7d633c33832b7ff2c02e19a144705036)"},"addedDate":"2026-10-30"},{"version":"Linux 6.6 stable (upstream)","status":"affected","versions":"6.6: >= 6.6.159","vendorStatement":{"date":"2026-10-15","url":"https://kernel.googlesource.com/pub/scm/linux/security/vulns/+/refs/heads/master/cve/published/2026/CVE-2026-98432.mbox","quote":"Fixed in 6.6.159 (742f73df544e03744f2981c467d6542fe8172a2a)"},"addedDate":"2026-10-30"},{"version":"Linux 6.12 stable (upstream)","status":"affected","versions":"6.12: >= 6.12.113","vendorStatement":{"date":"2026-10-15","url":"https://kernel.googlesource.com/pub/scm/linux/security/vulns/+/refs/heads/master/cve/published/2026/CVE-2026-98432.mbox","quote":"Fixed in 6.12.113 (11a03ce3c4a62d84c10ccdfe47f8075006498568)"},"addedDate":"2026-10-30"},{"version":"Linux 6.18 stable (upstream)","status":"affected","versions":"6.18: >= 6.18.56","vendorStatement":{"date":"2026-10-15","url":"https://kernel.googlesource.com/pub/scm/linux/security/vulns/+/refs/heads/master/cve/published/2026/CVE-2026-98432.mbox","quote":"Fixed in 6.18.56 (a47406c769f72c070386985488f1c4d057df86b2)"},"addedDate":"2026-10-30"},{"version":"Linux 7.2 stable (upstream)","status":"affected","versions":"7.2: >= 7.2.10","vendorStatement":{"date":"2026-10-15","url":"https://kernel.googlesource.com/pub/scm/linux/security/vulns/+/refs/heads/master/cve/published/2026/CVE-2026-98432.mbox","quote":"Fixed in 7.2.10 (26d4c36d318cffbbd160884a0e4cec0da4da4936)"},"addedDate":"2026-10-30"},{"version":"Linux mainline (upstream)","status":"affected","versions":"7.3: >= 7.3","vendorStatement":{"date":"2026-10-15","url":"https://kernel.googlesource.com/pub/scm/linux/security/vulns/+/refs/heads/master/cve/published/2026/CVE-2026-98432.mbox","quote":"Fixed in 7.3 (e3f33b0a1d89d738e2b913dab519226eaf76e15b). The 15 Oct 2026 mailing-list text says 7.3-rc7; Debian notes 7.3-rc7."},"addedDate":"2026-10-30"},{"version":"Linux versions below 4.4 (upstream)","status":"vendor-stated-not-affected","versions":"Not stated","vendorStatement":{"date":"2026-10-15","url":"https://kernel.googlesource.com/pub/scm/linux/security/vulns/+/refs/heads/master/cve/published/2026/CVE-2026-98432.mbox","quote":"CNA: issue introduced in 4.4. Versions below 4.4 are unaffected."},"addedDate":"2026-10-30"},{"version":"Linux 4.4 and other stables with no CNA Fixed in line","status":"affected","versions":"No fix yet","vendorStatement":{"date":"2026-10-15","url":"https://www.cve.org/CVERecord?id=CVE-2026-98432","quote":"CNA scope starts at 4.4 (versions below 4.4 are unaffected). Branches not on the Fixed in list have no CNA fix listed; that is not the same as unaffected. CNA: update to the latest stable; do not cherry-pick."},"addedDate":"2026-10-30"},{"version":"Debian bookworm (security) linux","status":"affected","versions":"bookworm: >= 6.1.190-1","vendorStatement":{"date":"2026-10-30","url":"https://security-tracker.debian.org/tracker/CVE-2026-98432","quote":"bookworm (security) 6.1.190-1 fixed (DLA-4841-1). Base bookworm 6.1.176-1 is still listed vulnerable (superseded by the security row)."},"addedDate":"2026-10-30"},{"version":"Debian bookworm linux-6.12","status":"affected","versions":"linux-6.12: >= 6.12.113-1~deb12u1","vendorStatement":{"date":"2026-10-30","url":"https://security-tracker.debian.org/tracker/CVE-2026-98432","quote":"bookworm linux-6.12 6.12.113-1~deb12u1 fixed (DLA-4850-1)"},"addedDate":"2026-10-30"},{"version":"Debian trixie (security) linux","status":"affected","versions":"trixie: >= 6.12.113-1","vendorStatement":{"date":"2026-10-30","url":"https://security-tracker.debian.org/tracker/CVE-2026-98432","quote":"trixie (security) 6.12.113-1 fixed (DSA-6568-1). Base trixie 6.12.107-1 is still listed vulnerable (superseded by the security row)."},"addedDate":"2026-10-30"},{"version":"Debian forky linux","status":"affected","versions":"forky: >= 7.2.12-1","vendorStatement":{"date":"2026-10-30","url":"https://security-tracker.debian.org/tracker/CVE-2026-98432","quote":"forky 7.2.12-1 fixed"},"addedDate":"2026-10-30"},{"version":"Debian sid linux","status":"affected","versions":"sid: >= 7.2.13-1","vendorStatement":{"date":"2026-10-30","url":"https://security-tracker.debian.org/tracker/CVE-2026-98432","quote":"sid 7.2.13-1 fixed"},"addedDate":"2026-10-30"},{"version":"Ubuntu linux 26.10 / 26.04 LTS / 24.04 LTS / 22.04 LTS","status":"affected","versions":"No fix yet","vendorStatement":{"date":"2026-10-29","url":"https://ubuntu.com/security/CVE-2026-98432","quote":"Ubuntu priority High. linux 26.10 / 26.04 LTS / 24.04 LTS / 22.04 LTS Vulnerable, work in progress (in 7.3.0-10.10, 7.0.0-43.43, 6.8.0-149.149, 5.15.0-203.213). No USN listed."},"addedDate":"2026-10-30"},{"version":"Ubuntu linux 20.04 / 18.04 / 16.04","status":"affected","versions":"No fix yet","vendorStatement":{"date":"2026-10-29","url":"https://ubuntu.com/security/CVE-2026-98432","quote":"Ubuntu priority High. 20.04, 18.04, 16.04 Vulnerable"},"addedDate":"2026-10-30"},{"version":"Ubuntu linux 14.04","status":"vendor-stated-not-affected","versions":"Not stated","vendorStatement":{"date":"2026-10-29","url":"https://ubuntu.com/security/CVE-2026-98432","quote":"14.04 Not affected (Ubuntu's own statement)"},"addedDate":"2026-10-30"},{"version":"Ubuntu cloud and flavour kernels (aws, azure, gcp, oracle, and others)","status":"affected","versions":"No fix yet","vendorStatement":{"date":"2026-10-29","url":"https://ubuntu.com/security/CVE-2026-98432","quote":"Ubuntu priority High. Cloud/other kernels mostly Vulnerable (work in progress) or Vulnerable. No USN listed."},"addedDate":"2026-10-30"},{"version":"RHEL 8, 9, 10 kernel (and kernel-rt on 8, 9)","status":"affected","versions":"No fix yet (checked 30 Oct 2026)","vendorStatement":{"date":"2026-10-30","url":"https://access.redhat.com/security/cve/CVE-2026-98432","quote":"RHEL 8, 9, 10 kernel (and kernel-rt on 8, 9) Affected (no fix shipped as of the page, checked 30 Oct 2026). Status from the JSON API; the portal HTML table did not render in the fetch."},"addedDate":"2026-10-30"},{"version":"RHEL 6 and 7 kernel","status":"vendor-stated-not-affected","versions":"Not stated","vendorStatement":{"date":"2026-10-15","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-98432.json","quote":"RHEL 6 and 7 Not affected (Red Hat's statement via the API)"},"addedDate":"2026-10-30"},{"version":"OpenShift 4 (coreos-8, coreos-9)","status":"affected","versions":"No fix yet (checked 30 Oct 2026)","vendorStatement":{"date":"2026-10-30","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-98432.json","quote":"OpenShift 4 (coreos-8, coreos-9) Affected (no fix shipped, checked 30 Oct 2026)"},"addedDate":"2026-10-30"},{"version":"SLES 16.0 kernel-default","status":"affected","versions":"SLES16: >= 6.12.0-160000.40.1","vendorStatement":{"date":"2026-10-29","url":"https://www.suse.com/security/cve/CVE-2026-98432.html","quote":"Released: SLES 16.0 kernel-default >= 6.12.0-160000.40.1, SUSE-SLES-16.0-1973. Advisories SUSE-SU-2026:24386-1 and SUSE-SU-2026:24422-1 (29 Oct 2026)."},"addedDate":"2026-10-30"},{"version":"SLE Micro 5.3/5.4/5.5 and SL Micro 6.2","status":"affected","versions":"Micro 5.3/5.4: kernel-default >= 5.14.21-150400.24.246.1\nMicro 5.5: kernel-default >= 5.14.21-150500.55.195.1\nSL Micro 6.2: >= 6.12.0-160000.40.1","vendorStatement":{"date":"2026-10-29","url":"https://www.suse.com/security/cve/CVE-2026-98432.html","quote":"Released: SLE Micro 5.3/5.4 kernel-default >= 5.14.21-150400.24.246.1; Micro 5.5 kernel-default >= 5.14.21-150500.55.195.1; SL Micro 6.2 kernel-default >= 6.12.0-160000.40.1"},"addedDate":"2026-10-30"},{"version":"SLES/SAP 15 SP4, SP5, SP6 LTSS","status":"affected","versions":"SP4: >= 5.14.21-150400.24.246.1\nSP5: >= 5.14.21-150500.55.195.1\nSP6: >= 6.4.0-150600.23.143.1","vendorStatement":{"date":"2026-10-29","url":"https://www.suse.com/security/cve/CVE-2026-98432.html","quote":"Released: SLES/SAP 15 SP4, SP5, SP6 LTSS (e.g. kernel-default >= 5.14.21-150400.24.246.1 / 150500.55.195.1 / 6.4.0-150600.23.143.1)"},"addedDate":"2026-10-30"},{"version":"SLES 15 SP7, SLES 12 SP5, SL Micro 6.0/6.1, openSUSE Leap 16.0 and 15.x","status":"affected","versions":"No fix yet","vendorStatement":{"date":"2026-10-29","url":"https://www.suse.com/security/cve/CVE-2026-98432.html","quote":"Affected, no fix yet: SLES 15 SP7, SLES 12 SP5 (and LTSS Extended Security), SL Micro 6.0/6.1, openSUSE Leap 16.0 kernel-source, openSUSE Leap 15.x. Overall state: Pending."},"addedDate":"2026-10-30"},{"version":"SLES 11 SP4 LTSS EXTREME CORE","status":"vendor-stated-not-affected","versions":"Not stated","vendorStatement":{"date":"2026-10-29","url":"https://www.suse.com/security/cve/CVE-2026-98432.html","quote":"SLES 11 SP4 LTSS EXTREME CORE Not affected (SUSE's statement)"},"addedDate":"2026-10-30"},{"version":"Amazon Linux 2023 kernel6.18","status":"affected","versions":"See ALAS2023-2026-3251","vendorStatement":{"date":"2026-10-24","url":"https://explore.alas.aws.amazon.com/CVE-2026-98432.html","quote":"AL2023 kernel6.18 fixed (ALAS2023-2026-3251, 24 Oct 2026)"},"addedDate":"2026-10-30"},{"version":"Amazon Linux 2023 kernel6.12","status":"affected","versions":"See ALAS2023-2026-3335","vendorStatement":{"date":"2026-10-29","url":"https://explore.alas.aws.amazon.com/CVE-2026-98432.html","quote":"AL2023 kernel6.12 fixed (ALAS2023-2026-3335, 29 Oct 2026)"},"addedDate":"2026-10-30"},{"version":"Amazon Linux 2023 default kernel, and Amazon Linux 2 (core, 5.4, 5.10, 5.15)","status":"affected","versions":"No fix yet","vendorStatement":{"date":"2026-10-29","url":"https://explore.alas.aws.amazon.com/CVE-2026-98432.html","quote":"AL2023 kernel (default) Pending Fix. AL2 core, 5.4, 5.10, 5.15 kernels: Pending Fix."},"addedDate":"2026-10-30"},{"version":"Oracle Linux UEK (OL7/OL8, OL8/OL9, OL9/OL10)","status":"affected","versions":"See ELSA-2026-500397 / 500398 / 500399","vendorStatement":{"date":"2026-10-16","url":"https://linux.oracle.com/cve/CVE-2026-98432.html","quote":"UEK errata released 16 Oct 2026: ELSA-2026-500397 (OL7/OL8 UEK), ELSA-2026-500398 (OL8/OL9 UEK), ELSA-2026-500399 (OL9/OL10 UEK). Advisory pages themselves were not opened."},"addedDate":"2026-10-30"},{"version":"Oracle Linux RHCK","status":"no-statement-yet","versions":"Not stated","addedDate":"2026-10-30"},{"version":"Azure Linux","status":"no-statement-yet","versions":"Not stated","addedDate":"2026-10-30"},{"version":"AlmaLinux / Rocky Linux","status":"no-statement-yet","versions":"Not stated","addedDate":"2026-10-30"},{"version":"Alpine Linux","status":"no-statement-yet","versions":"Not stated","addedDate":"2026-10-30"},{"version":"Arch Linux","status":"no-statement-yet","versions":"Not stated","addedDate":"2026-10-30"}]},"pocs":[],"pocEmptyState":"No public RCE or root exploit indexed. One public race-trigger, oracle and leak-analysis repo exists (H1z3-br0, 30 Oct 2026); its README says it is not a root exploit. Not reviewed by vuln2shell.","_feed":{"page":"https://vuln2shell.com/vulns/linux-kernel-tcp-uaf-cve-2026-98432","json":"https://vuln2shell.com/vulns/linux-kernel-tcp-uaf-cve-2026-98432.json","iocsCsv":"https://vuln2shell.com/vulns/linux-kernel-tcp-uaf-cve-2026-98432/iocs.csv","stix":"https://vuln2shell.com/vulns/linux-kernel-tcp-uaf-cve-2026-98432/stix.json","badges":{"patch":"Partly patched","itw":"No known ITW","poc":"No public PoC indexed"}}}