Linux TCP Flaw CVE-2026-98432: Ubuntu's Fix Is Still Opt-In

If you run Ubuntu 22.04, 24.04 or 26.04, the fix for CVE-2026-98432 exists, and you have to ask for it. On Nov. 2, Canonical put patched kernels for the 9.8-rated Linux TCP flaw into the -proposed pocket, an opt-in testing channel, and gave no date for moving them into regular updates. Red Hat had already shipped fixes for RHEL 8, 9 and 10 the day before.

Ubuntu's post on X, Nov. 3, 2026, pointing to its blog on the -proposed fixes (@ubuntu)

View on X

Ubuntu's post is one line and a link: "Fixes available in -proposed pocket for CVE-2026-98432. Read the blog for more details."

The Hacker News on X, Nov. 3, 2026, summarizing the Ubuntu and Red Hat situation (@TheHackersNews)

View on X

The Hacker News calls the Ubuntu fixes "test patches," says there is "no date for regular updates," and adds that disabling MPTCP is "not enough." Its report fills in the rest.

A use-after-free in every IPv4 handshake

Ubuntu's CVE page describes a flaw in how the Linux kernel's IPv4 TCP code builds the reply to a new connection. The child socket can be freed while the kernel is still reading the IP options, a use-after-free. Canonical says it can lead to remote code execution, and its blog says the flaw is present in kernel versions 4.4 and later and scores 9.8 on CVSS 3.1, "Critical."

IPv6 isn't affected by this first issue, according to the page, because the IPv6 path copies the options. A similar problem in the IPv6 path, tied to a rarely used option, is described as "handled in a separate patch."

Fixed upstream in October, opt-in on Ubuntu

The Hacker News reports that the upstream fix landed in October and that Debian, Oracle Linux and SUSE shipped fixes that month, with Amazon Linux fixing its packages between Oct. 24 and 30. We didn't open those vendors' advisories, so treat those dates as the outlet's reporting.

Red Hat's fixes are RHSA-2026:93414 for RHEL 8, 93412 for RHEL 9 and 93413 for RHEL 10.2, per The Hacker News, and all need a reboot. Ubuntu's are kernel 5.15.0-203.213 on 22.04, 6.8.0-149.149 on 24.04 and 7.0.0-43.43 on 26.04. They aren't picked up by a normal upgrade, so you enable the pocket and request them by name, then reboot. Canonical says it tests on "more than 2,000 certified servers and devices" before promoting kernels, and that the older 20.04, 18.04 and 16.04 releases are still pending.

Our reading: the delay is a process choice, not a missing patch, and the replies under Ubuntu's post show the frustration. At least one asks why other distributions had fixes weeks earlier. Canonical's blog doesn't answer that, and doesn't say when testing ends.

One more thing to check: the two Ubuntu pages disagree about 26.10. The blog lists it as "Fixed in 7.3.0-10.10," while the CVE page lists the same version as "Vulnerable, work in progress." We can't tell which is current.

What Anthropic did and didn't show

The Linux bug is one of several in an Oct. 27 post from Anthropic's Frontier Red Team, which says "an unreleased, internal research model" wrote exploits for real software. For this CVE, the post says the proof of concept takes 48 minutes to leak a kernel pointer and five more to run commands as root against a server with a Multipath TCP listener. Those are Anthropic's lab timings, not a measure of what an attacker would face on the internet.

Anthropic hasn't published the exploit, and The Hacker News says no vendor, CERT or the kernel CVE team had reported attacks. The outlet also says the flaw wasn't in CISA's Known Exploited Vulnerabilities catalog as of Oct. 30. It adds that "proof-only" code on GitHub triggers the race without executing code; we haven't reviewed it. Anthropic notes the race is retryable, since losing it only fails the handshake.

Two mitigations that don't finish the job

• Disabling MPTCP. Canonical says the recommendation exists only because Anthropic's exploit uses MPTCP, and the flaw is in the IPv4 TCP path. Its position: "security updates are the only appropriate mitigation."
• The nftables rule. Red Hat published a rule on Oct. 30 that drops inbound IPv4 TCP packets with IP options. Red Hat says it can't fully prevent exploitation and may break workloads that use those options. A CIQ kernel developer, as reported, noted it applies only on the host that loads it, so traffic between containers on one host can bypass it. A version of the rule on Ubuntu's CVE page was written by a community member, not by Ubuntu.

What the cloud kernels still owe you

The CVE page lists work in progress for linux-aws, linux-azure, linux-gcp and the FIPS kernels, each with its own version number. If you run Ubuntu in a cloud image or a FIPS build, the generic kernel numbers above don't apply to you. Look up your package's row on the CVE page before you decide the -proposed kernel is your fix, and check it again after Canonical updates the blog.

Source: Ubuntu, Fixes available in -proposed pocket for CVE-2026-98432

cve 2026 98432 ubuntu linux kernel red hat anthropic

AI

About the author

AI Briefing Daily Editorial. The editorial desk of AI Briefing Daily, an independent publication covering artificial intelligence. Every story is researched against primary sources, checked by hand and reviewed by a person before publication.