Security
Docs home

CVE-2026-98432: Linux Kernel TCP Vulnerability

Open as Markdown Suggest an edit
3 min read

Vulnerability Alert

Important

Published: November 4, 2026. What to do: update the kernel of every Linux VM and reboot it. If your OS is no longer supported, move to a supported version.

What Happened

CVE-2026-98432 is a vulnerability in the Linux kernel code that handles IPv4 TCP connections (a use-after-free error). It has been present in the kernel since version 4.4, so it affects almost all Linux distributions in use today.

  • The Linux kernel CVE team rated the vulnerability 9.8 out of 10 (critical). Red Hat rates it lower — 8.1 (important) — because exploitation requires winning a race condition.
  • Anthropic has reported that its internal research AI model created a working exploit that gives an attacker remote root access without a password. The exploit targets servers with an MPTCP (multipath TCP) listener.
  • At the time of publication, no public exploit has been released and no attacks have been reported. But now that the vulnerability is known, attempts to exploit it should be expected.

Windows VMs and other non-Linux systems are not affected.

Who Needs to Act

The kernel inside your VM is managed by you — the platform cannot update it for you. Follow the steps below on every Linux VM, including VMs created recently.

How to Protect Your VM

1. Take a snapshot of the VM before updating. See Create Instance Snapshot.

2. Install updates and reboot:

# Ubuntu and Debian
sudo apt update && sudo apt upgrade -y && sudo reboot

# Rocky Linux, AlmaLinux, RHEL, Oracle Linux
sudo dnf update -y && sudo reboot

# SUSE
sudo zypper refresh && sudo zypper patch && sudo reboot

The reboot is required: until then, the vulnerable kernel keeps running.

3. Check that the kernel is fixed. After the reboot, find out the kernel version:

uname -r

Compare it with the fixed version in your distribution’s advisory:

Note

The fix is already in the main Linux kernel, but distributions release updated packages at different times. If apt upgrade or dnf update doesn’t install a fixed kernel yet, check the advisory of your distribution again later, and apply the measures from step 5 in the meantime.

4. If your OS is no longer supported (CentOS 7 or 8, Ubuntu 20.04 or earlier, Debian 11 or earlier), the vendor will not release a fix. Move to a supported OS version — see Update the Operating System.

5. While the fix is not installed, reduce the risk:

  • Close all ports that don’t need to be reachable from the internet, and allow SSH only from your IP addresses or through VPN. See Network Access.

  • Check whether MPTCP listeners are running on the VM:

    ss -Mltn

    If you don’t use MPTCP (it’s rarely used on regular servers), you can disable it:

    sudo sysctl -w net.mptcp.enabled=0
echo "net.mptcp.enabled = 0" | sudo tee /etc/sysctl.d/90-disable-mptcp.conf

    Warning

    Disabling MPTCP closes the attack path described by Anthropic, but it does not fix the vulnerability: the bug is in the common TCP code. Use this only as a temporary measure until you update the kernel.

Ready-Made Images and Appliances

If your VM was created from a ready-made application image (for example, telephony or network appliances), update it using the tools provided by the vendor of that system, and restrict access to its web interface to your IP addresses or VPN.

Need Help?

If your server is critical or you’re not sure how to update it safely, contact support before you start.

Tip

See also:

Back to documentation