Linux servers: fixed kernels for the remote-root TCP bug are out, and they only count after a reboot

Yesterday we listed this Linux kernel bug on the radar: a flaw in how the kernel sets up IPv4 TCP connections, present since Linux 4.4. Since then the fixed kernels have started to arrive. Red Hat shipped one for RHEL 8 on Sunday, AWS has patched images out, and Ubuntu put fixes for its supported LTS releases into testing on Monday.

The reason to move this week: Anthropic, whose researcher reported the bug, says it built an exploit that runs commands as root on a Linux server from the network, with no login. It has not released that exploit, and nobody has reported attacks. A kernel fix only counts after a reboot, so this one needs a maintenance window.

The fix for this Linux bug is a kernel update and a reboot. Until the box restarts, it is still running the old kernel.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Red Hat and AWS ship fixed kernels, Ubuntu’s are in testing

The bug is CVE-2026-98432, a use-after-free in IPv4 TCP connection setup. When a connection request carries IPv4 options and is retransmitted, one CPU can free the stored options while another is still building the reply. The fix, by Eric Dumazet, landed upstream on October 5, and the kernel CVE team published the CVE on October 15 with a CVSS 3.1 score of 9.8.

On October 27 Anthropic reported a remote root exploit against servers with a Multipath TCP (MPTCP) listener. Two days later the Go Security Team warned that programs built with Go 1.24 or later open MPTCP listeners on Linux by default. Both Go and Red Hat stress that the bug itself is not specific to MPTCP.

Fixed kernels so far: Red Hat RHSA-2026:93414 for RHEL 8 (November 1, rated Critical), Amazon Linux 2 and Amazon Linux 2023, and some Debian, SUSE and Oracle Linux releases, according to Akamai. Ubuntu’s fixes for 22.04, 24.04 and 26.04 sit in the -proposed pocket while Canonical tests them on more than 2,000 certified machines.

Any Linux server that accepts IPv4 connections

Any system on a kernel from 4.4 onward without the fix is in scope if it accepts IPv4 TCP connections from a network you do not control. Red Hat lists RHEL 8, 9 and 10 and OpenShift as affected, and says OpenShift nodes in their default setup, with MPTCP off, are still exposed.

Cloud services are not a blanket shield. AWS says Network Load Balancer TCP listeners pass IP options straight through to the Linux targets behind them, so those targets need the kernel update. Its RDS and Aurora OS patch is due Tuesday, November 3.

Install the fixed kernel, reboot, and check what is running

• Find internet-facing Linux hosts first: load balancer targets, VPN and proxy boxes, and anything running Go services built with Go 1.24 or later.
• Install your distribution’s fixed kernel and reboot: RHEL 8 4.18.0-553.182.1.el8_10, the Amazon Linux kernels in AWS bulletin 2026-160-AWS, or a stable kernel at 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 or 7.3.
• On Ubuntu 22.04, 24.04 or 26.04, decide whether to take the -proposed kernel now (Canonical’s blog has the commands) or wait for the updates pocket. Older Ubuntu releases still show the fix as pending.
• Until you can reboot, set net.mptcp.enabled=0 and GODEBUG=multipathtcp=0 for Go services, and drop inbound IPv4 packets that carry IP options with the nftables rule in Red Hat’s bulletin. Both reduce exposure; neither fixes the bug.
• If kernel and reboot hygiene keeps slipping on your team, our GSEC exam guide covers the Linux hardening basics this kind of week depends on.

Details

• CVE-2026-98432: Linux kernel IPv4 TCP use-after-free (ipv4: free inet_opt and ireq_opt after an RCU grace period). Introduced in 4.4, CVSS 3.1 9.8 from the kernel CNA, published October 15, 2026. A second path exists when request socket migration is on (net.ipv4.tcp_migrate_req=1). IPv6 is not affected by the main path.
• Exploit status: Anthropic reported a remote root exploit against MPTCP listeners on October 27 and has not released it. Akamai knew of no public working exploit on November 2, and AWS has no evidence of use. Not on CISA’s KEV list.
• Ubuntu (November 2): -proposed kernels 5.15.0-203.213 (22.04), 6.8.0-149.149 (24.04), 7.0.0-43.43 (26.04); 26.10 fixed in 7.3.0-10.10; 16.04, 18.04 and 20.04 pending.
• AWS: EKS-optimized AL2023 AMIs v20261031 and ECS-optimized AMI 20261031 carry the fix; Fargate tasks launched after November 1, 9:00 AM PST run patched; Bottlerocket AMIs from November 2.

Hunt / verify

• Run uname -r on each host and compare it with your vendor’s fixed version. A newer kernel package on disk does not help until the machine reboots into it.
• Run sudo ss -M -l -n -p -e to list MPTCP listeners, and sysctl net.mptcp.enabled net.ipv4.tcp_migrate_req to see the current settings (Akamai’s checks).
• If you applied Red Hat’s nftables rule, sudo nft list table inet cve_2026_98432 shows the drop counter. A rising count means IP-options traffic is reaching that host and the reboot should move up the list.

Source: Red Hat bulletin RHSB-2026-016; AWS bulletin 2026-160-AWS

Sources

• Akamai: CVE-2026-98432, A Remote Use-After-Free in the Linux Kernel’s TCP Stack (November 2, 2026)
• linux-cve-announce: CVE-2026-98432, ipv4: free inet_opt and ireq_opt after an RCU grace period
• Ubuntu: Fixes available in -proposed pocket for CVE-2026-98432 (November 2, 2026)
• Ubuntu CVE page: CVE-2026-98432
• Red Hat: RHSB-2026-016 Use-after-free, kernel IPv4 (CVE-2026-98432)
• Red Hat: RHSA-2026:93414, Critical kernel security update for RHEL 8
• AWS Security Bulletin 2026-160-AWS: CVE-2026-98432
• Go Security Team: Protecting against CVE-2026-98432 (golang-announce)
• AlmaLinux: CVE-2026-98432 patched kernels released
• Anthropic: Discovering and exploiting vulnerabilities in critical, real-world software with Claude
• NVD: CVE-2026-98432

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].