{"id":12295,"date":"2026-10-28T21:12:35","date_gmt":"2026-10-29T03:12:35","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-130-critical-vulnerability-in-the-linux-kernel-cve-2026-98432-with-a-lab-exploit-that-achieves-remote-root-access\/"},"modified":"2026-10-28T21:28:28","modified_gmt":"2026-10-29T03:28:28","slug":"alert-2026-130-critical-vulnerability-in-the-linux-kernel-cve-2026-98432-with-a-lab-exploit-that-achieves-remote-root-access","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-130-critical-vulnerability-in-the-linux-kernel-cve-2026-98432-with-a-lab-exploit-that-achieves-remote-root-access\/","title":{"rendered":"Alert 2026-130: Critical Vulnerability in the Linux Kernel (CVE-2026-98432) with a Lab Exploit Achieving Remote Root Access"},"content":{"rendered":"\n

Affected product(s):\u00a0<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td>Status \/ fixed version<\/strong><\/td><\/tr>
Linux Kernel (upstream)<\/strong><\/td>From the 4.4 branch, versions earlier than the fixed version for each branch<\/td>5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3<\/td><\/tr>
Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10<\/strong><\/td>Vulnerable<\/td>Fix in progress; no fixed kernel available yet<\/td><\/tr>
Ubuntu 20.04, 18.04 and 16.04<\/strong><\/td>Vulnerable<\/td>No fixed kernel available<\/td><\/tr>
Debian 12 (bookworm) and Debian 13 (trixie)<\/strong><\/td>Kernels earlier than 6.1.190-1 (bookworm) and 6.12.113-1 (trixie)<\/td>Fixed in: 6.1.190-1 and 6.12.113-1 (bookworm also with linux-6.12 6.12.113-1~deb12u1)<\/td><\/tr>
Red Hat Enterprise Linux 8, 9 and 10 (including RT), In-Vehicle OS 2 and OpenShift 4 RHCOS nodes<\/strong><\/td>Affected<\/td>Fix deferred; mitigation unavailable<\/td><\/tr>
SUSE Linux Micro 6.2 and openSUSE Leap 16.0<\/strong><\/td>Kernels earlier than 6.12.0-160000.40.1<\/td>Fixed in: 6.12.0-160000.40.1 or later<\/td><\/tr>
SUSE Linux Enterprise Server 15 SP4 through SP7 and 16.0, and SUSE Linux Micro 5.x<\/strong><\/td>Affected<\/td>Fix in progress<\/td><\/tr>
Oracle Linux (UEK kernels)<\/strong><\/td>Affected<\/td>Fixed by errata ELSA-2026-500397 (OL7 and OL8), ELSA-2026-500398 (OL8 and OL9) and ELSA-2026-500399 (OL9 and OL10), published on 16\/10\/2026<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Ubuntu 14.04, Red Hat Enterprise Linux 7 and SUSE Linux Enterprise Server 11 SP4 are not affected. Appliances and unlisted distributions must be checked with their vendor.<\/p>\n\n

Description<\/h2>\n\n

A critical vulnerability has been publicly disclosed in the Linux kernel (CVSSv3.1 9.8 – CRITICAL according to the kernel CNA): a race-condition use-after-free in the IPv4 TCP stack, tagged as CVE-2026-98432. Researchers demonstrated in a lab that, on servers with an MPTCP (Multipath TCP) listener, it can be chained to achieve remote code execution as root, without credentials.<\/p>\n\n

The flaw occurs because the IP options of the connection request (inet_opt<\/code> and ireq_opt<\/code>) are freed without waiting for an RCU grace period. If another CPU processes a retransmitted SYN while the child socket is being destroyed, freed memory is read in ip_options_build()<\/code>. An analogous case exists with request socket migration (net.ipv4.tcp_migrate_req=1<\/code> or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE<\/code> program). IPv6 is not affected by the first issue; its analogous case, which applies only with CALIPSO, will be addressed in a separate patch. The defect was introduced in commit 079096f103fa<\/code> and fixed in commit e3f33b0a1d89<\/code> (7.3-rc7). The CVE was published on 15\/10\/2026.<\/p>\n\n

On 27\/10\/2026, researchers published a report containing a lab exploit chain that achieves remote root access, without credentials or interaction, against Linux servers with an MPTCP listener: approximately 48 minutes to leak a kernel pointer and approximately 5 minutes to obtain a shell, approximately 53 minutes in total. They also state that a lost race only causes the handshake to fail, without a system crash, so the attempt can be repeated. The exploit code has not been published.<\/p>\n\n

The CVE record describes a flaw in the IPv4 TCP stack and does not mention MPTCP; the link to MPTCP and remote code execution comes solely from the researchers’ report. It has not been confirmed whether servers without MPTCP permit remote code execution, nor which distribution services open MPTCP listeners by default. The kernel’s ability to create MPTCP sockets (net.mptcp.enabled<\/code>, default value 1) does not imply that a listener exists: the application must create the MPTCP socket.<\/p>\n\n

The vulnerability is not listed in the U.S. cybersecurity agency’s Known Exploited Vulnerabilities (KEV) catalog, and no active exploitation is known.<\/p>\n\n

Severity according to the kernel CNA and the distributions<\/strong><\/p>\n\n

The kernel CNA assigns CVSS 9.8 (critical). The distributions score the vulnerability differently: three of them rate its attack complexity as high, while one considers denial of service to be the worst practical outcome.<\/p>\n\n

Source<\/strong><\/td>Score<\/strong><\/td>Observation<\/strong><\/td><\/tr>
Kernel CNA<\/strong><\/td>CVSS 3.1: 9.8 (critical)<\/td>Network vector, low complexity, no privileges or interaction<\/td><\/tr>
Ubuntu<\/strong><\/td>High priority; CVSS 3: 9.8 (critical); CVSS 4.0: 8.3 (high)<\/td>The CVSS 4.0 assessor is not identified<\/td><\/tr>
Red Hat<\/strong><\/td>CVSS 3.1: 5.9 (moderate)<\/td>High complexity; the practical impact is a kernel crash or denial of service<\/td><\/tr>
SUSE<\/strong><\/td>CVSS 3.1: 8.1; CVSS 4.0: 9.2 (high severity)<\/td>High complexity<\/td><\/tr>
Oracle Linux<\/strong><\/td>CVSS 3.1: 8.1 (high, preliminary)<\/td>High complexity<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

Mitigation<\/h2>\n\n

No vendor has confirmed a mitigation for this vulnerability: one distribution explicitly stated that no mitigation is available. The only confirmed remediation is to install the fixed kernel and reboot the system. In the meantime, the following general recommendations apply:<\/p>\n\n