Ubuntu’s kernel fix queue moves on CVE-2026-98432

Ubuntu has placed early Linux kernel fixes for CVE-2026-98432 in the -proposed pocket for 22.04 LTS and newer releases. The flaw can let a remote user run commands as root without a login or any user action, and the patches are still in testing.

Kernel versions and patch status

Canonical’s security team says the flaw sits in the way the Linux kernel sets up IPv4 TCP connections, and it affects kernel versions 4.4 and later. The fixed builds are 5.15.0-203.213 for Jammy (22.04), 6.8.0-149.149 for Noble (24.04), and 7.0.0-43.43 for Resolute (26.04). Stonking (26.10) is already fixed in 7.3.0-10.10, Trusty (14.04) is not affected, and fixes for Xenial, Bionic, and Focal are still pending.

Canonical runs tests on more than 2,000 certified servers and devices before moving a kernel to the updates pocket. Teams that run their own acceptance tests can install the early builds today, following Canonical’s new SRU strategy for faster CVE fixes.

The severity record and its label

Ubuntu’s CVE-2026-98432 tracker rates the bug 9.8, which is Critical. Its own blog post uses the label “High” for the same score, so both labels appear in the record. The tracker entry was published on October 15, 2026.

How the flaw behaves

The bug is a use-after-free. In plain terms, the kernel keeps using memory after it has already released it. One CPU frees the IP options for a new connection, while another CPU handling a repeated SYN packet still reads them while building a reply. The upstream fix delays that free with kfree_rcu(), so readers finish first.

Anthropic’s exploit test

Anthropic’s Frontier Red Team shared research on October 27, 2026. It says an unreleased Claude model wrote a working exploit after one first prompt, and the exploit targets Linux servers with a multipath TCP listener. The test was a lab exercise and not a real-world incident, and Anthropic has not released the exploit.

The exploit works in two stages. First, it makes the kernel send back extra bytes that may contain a kernel pointer, which defeats KASLR, the defense that hides where kernel code sits. Second, it overwrites a callback pointer so the kernel runs a payload and ends in a shell command as root. A failed race only breaks the handshake and does not crash the machine, so the attacker can try again. In the test, the leak took 48 minutes, and the shell took five more.

Signs of scanning on the internet

Researcher Marcus Hutchins says his team has seen what looks like threat actors scanning the internet for affected systems. In a post on X, he said residential proxies and Russia-based VPN servers began probing port 443 with MPTCP connections as of November 2. He suspects the activity targets CVE-2026-98432 because normal scanners do not use MPTCP by default.

His scan on October 30 found about 2,102,043 servers reachable over MPTCP on port 443. A deeper TLS scan found about 762,774. He said a valid HTTP request is not needed, so the true exposure is likely closer to 2.1 million. Those counts show exposure only and do not prove the kernels are unpatched. There is no public remote code execution exploit yet, though several denial-of-service proofs of concept exist.

MPTCP listeners and Ubuntu’s fix advice

Hutchins said some people assumed MPTCP listeners were rare, but Debian and several other kernels enable MPTCP by default. Go 1.24 and later also bind MPTCP sockets when the kernel allows it, so tools built on Go, such as Caddy, create the needed listener. Ubuntu says the flaw itself is not tied to MPTCP, and the MPTCP link comes only from the Anthropic exploit. Ubuntu’s security team says updates are the only proper fix.

Hutchins also said setting net.mptcp.enabled=0 does not close sockets that are already open, so those apps must restart. MPTCP listeners can be listed with sudo ss -Mlnp.

How to apply the Ubuntu update

Admins can run uname -r and compare the result with the fixed versions above. Ubuntu’s guide to enabling the -proposed pocket explains how to pull in the new kernel, and a reboot is needed afterward. Packages in -proposed are not selected for upgrade by default, so the pocket has to be named during installation.

For hosts that cannot update yet, Ubuntu’s tracker lists an nftables rule that drops incoming IPv4 TCP packets carrying IP options. It reduces risk but does not fully prevent exploitation, and it breaks any connection that relies on IP options.

Ubuntu 20.04 LTS and older need Ubuntu Pro. Focal and Bionic fall under Expanded Security Maintenance, while Xenial and Trusty need the Legacy add-on. Ubuntu Pro is free for up to five machines.

Licensed under CC BY-ND 4.0 International