I’M UNDER A CYBER ATTACK

Alert

Alert 2026-130: Critical Vulnerability in the Linux Kernel (CVE-2026-98432) with a Lab Exploit Achieving Remote Root Access

Affected product(s): 

ProductAffected versionsStatus / fixed version
Linux Kernel (upstream)From the 4.4 branch, versions earlier than the fixed version for each branch5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3
Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10VulnerableFix in progress; no fixed kernel available yet
Ubuntu 20.04, 18.04 and 16.04VulnerableNo fixed kernel available
Debian 12 (bookworm) and Debian 13 (trixie)Kernels earlier than 6.1.190-1 (bookworm) and 6.12.113-1 (trixie)Fixed in: 6.1.190-1 and 6.12.113-1 (bookworm also with linux-6.12 6.12.113-1~deb12u1)
Red Hat Enterprise Linux 8, 9 and 10 (including RT), In-Vehicle OS 2 and OpenShift 4 RHCOS nodesAffectedFix deferred; mitigation unavailable
SUSE Linux Micro 6.2 and openSUSE Leap 16.0Kernels earlier than 6.12.0-160000.40.1Fixed in: 6.12.0-160000.40.1 or later
SUSE Linux Enterprise Server 15 SP4 through SP7 and 16.0, and SUSE Linux Micro 5.xAffectedFix in progress
Oracle Linux (UEK kernels)AffectedFixed by errata ELSA-2026-500397 (OL7 and OL8), ELSA-2026-500398 (OL8 and OL9) and ELSA-2026-500399 (OL9 and OL10), published on 16/10/2026

Ubuntu 14.04, Red Hat Enterprise Linux 7 and SUSE Linux Enterprise Server 11 SP4 are not affected. Appliances and unlisted distributions must be checked with their vendor.

Description

A critical vulnerability has been publicly disclosed in the Linux kernel (CVSSv3.1 9.8 – CRITICAL according to the kernel CNA): a race-condition use-after-free in the IPv4 TCP stack, tagged as CVE-2026-98432. Researchers demonstrated in a lab that, on servers with an MPTCP (Multipath TCP) listener, it can be chained to achieve remote code execution as root, without credentials.

The flaw occurs because the IP options of the connection request (inet_opt and ireq_opt) are freed without waiting for an RCU grace period. If another CPU processes a retransmitted SYN while the child socket is being destroyed, freed memory is read in ip_options_build(). An analogous case exists with request socket migration (net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). IPv6 is not affected by the first issue; its analogous case, which applies only with CALIPSO, will be addressed in a separate patch. The defect was introduced in commit 079096f103fa and fixed in commit e3f33b0a1d89 (7.3-rc7). The CVE was published on 15/10/2026.

On 27/10/2026, researchers published a report containing a lab exploit chain that achieves remote root access, without credentials or interaction, against Linux servers with an MPTCP listener: approximately 48 minutes to leak a kernel pointer and approximately 5 minutes to obtain a shell, approximately 53 minutes in total. They also state that a lost race only causes the handshake to fail, without a system crash, so the attempt can be repeated. The exploit code has not been published.

The CVE record describes a flaw in the IPv4 TCP stack and does not mention MPTCP; the link to MPTCP and remote code execution comes solely from the researchers’ report. It has not been confirmed whether servers without MPTCP permit remote code execution, nor which distribution services open MPTCP listeners by default. The kernel’s ability to create MPTCP sockets (net.mptcp.enabled, default value 1) does not imply that a listener exists: the application must create the MPTCP socket.

The vulnerability is not listed in the U.S. cybersecurity agency’s Known Exploited Vulnerabilities (KEV) catalog, and no active exploitation is known.

Severity according to the kernel CNA and the distributions

The kernel CNA assigns CVSS 9.8 (critical). The distributions score the vulnerability differently: three of them rate its attack complexity as high, while one considers denial of service to be the worst practical outcome.

SourceScoreObservation
Kernel CNACVSS 3.1: 9.8 (critical)Network vector, low complexity, no privileges or interaction
UbuntuHigh priority; CVSS 3: 9.8 (critical); CVSS 4.0: 8.3 (high)The CVSS 4.0 assessor is not identified
Red HatCVSS 3.1: 5.9 (moderate)High complexity; the practical impact is a kernel crash or denial of service
SUSECVSS 3.1: 8.1; CVSS 4.0: 9.2 (high severity)High complexity
Oracle LinuxCVSS 3.1: 8.1 (high, preliminary)High complexity

Mitigation

No vendor has confirmed a mitigation for this vulnerability: one distribution explicitly stated that no mitigation is available. The only confirmed remediation is to install the fixed kernel and reboot the system. In the meantime, the following general recommendations apply:

  • Inventory and review Linux servers and Linux-based appliances (consulting each appliance’s manufacturer), including services that use an MPTCP listener, prioritizing those exposed to the Internet.
  • Monitor the security advisories from each distribution to learn when the fixed kernel is released.
  • As an optional measure to reduce the attack surface, where MPTCP is not in use, it can be disabled with sysctl -w net.mptcp.enabled=0. No vendor endorses this as a mitigation for this CVE, and it does not fix the TCP flaw; it should be tested before being applied.

Solution

The solution is to install the fixed kernel for the distribution in use as soon as it becomes available and reboot the system to load it. Current status:

  • Upstream kernel: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 or 7.3.
  • Debian: has already released the fixed kernel (6.1.190-1 for bookworm and 6.12.113-1 for trixie).
  • Oracle Linux: UEK errata published on 16/10/2026.
  • SUSE: fixed kernel available only for SUSE Linux Micro 6.2 and openSUSE Leap 16.0; fixes for the remaining products are in progress.
  • Ubuntu: fix in progress; no kernel is yet listed as fixed.
  • Red Hat: fix is deferred.

The fixed kernel should be applied to every system as soon as its distribution releases it, including internal servers.

Additional information: