Researchers Report Root-Level Execution via Linux TCP Flaw CVE-2026-98432
Summary
Researchers reported exploiting Linux kernel flaw CVE-2026-98432 to run commands as root on a server with an exposed MPTCP listener. Patches are available for some distributions; no in-the-wild exploitation had been publicly reported.
Key points
- CVE-2026-98432 is a Linux kernel use-after-free in networking code that can be reached remotely without authentication or user interaction.
- Researchers reported leaking kernel memory to bypass KASLR, then corrupting memory and redirecting execution to run a command with root privileges.
- The demonstrated attack targeted a server with an exposed MPTCP listener; the article says the research's broader applicability across configurations remains unclear.
- Researchers reported that failed attempts generally caused TCP handshakes to fail rather than crash the target, allowing repeated attempts.
- The Linux kernel CVE team assigned a CVSS score of 9.8; some vendors rated the flaw lower, citing the difficulty of reliably exploiting its race condition.
- As of late October 2026, patched kernels were available from Debian, SUSE, Proxmox, and Amazon Linux 2023; AlmaLinux fixes were in testing, while supported Ubuntu and Red Hat Enterprise Linux releases were still awaiting fixes.
- Recommended measures include installing vendor-patched kernels, rebooting into the updated kernel, reviewing exposed Linux hosts, and limiting unnecessary network access.
Article Details
- Vulnerability Types
- Use-after-free
- Severity
- CVSS 9.8
- Affected Versions
- Linux kernel versions since 4.4
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Disable MPTCP where it is not required.
- Where a vendor fix is unavailable, evaluate network controls that restrict inbound TCP traffic carrying IPv4 options.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationResearchers reported exploiting the kernel flaw to redirect execution to attacker-controlled code and run a command with root privileges.T1210 · Exploitation of Remote ServicesResearchers reported remotely exploiting the Linux kernel TCP flaw through network traffic to a server.
CVE
Vendors
AlmaLinuxAlmaLinux had fixes available in testing repositories, while Amazon Linux 2023 had released fixes for its 6.12 and 6.18 kernel streams.Amazon LinuxAlmaLinux had fixes available in testing repositories, while Amazon Linux 2023 had released fixes for its 6.12 and 6.18 kernel streams.DebianAs of late October 2026, Debian, SUSE, and Proxmox had released patched kernels.ProxmoxAs of late October 2026, Debian, SUSE, and Proxmox had released patched kernels.Red HatFixed kernels were still pending for several major platforms, including supported releases of Ubuntu and Red Hat Enterprise Linux.SUSEAs of late October 2026, Debian, SUSE, and Proxmox had released patched kernels.UbuntuFixed kernels were still pending for several major platforms, including supported releases of Ubuntu and Red Hat Enterprise Linux.
Products
Amazon Linux 2023AlmaLinux had fixes available in testing repositories, while Amazon Linux 2023 had released fixes for its 6.12 and 6.18 kernel streams.Linux kernelUpstream Linux kernel fixes were released in October 2026 and have been backported to maintained kernel branches, with distribution-specific release timelines varying by vendor.Red Hat Enterprise LinuxFixed kernels were still pending for several major platforms, including supported releases of Ubuntu and Red Hat Enterprise Linux.