CVE-2026-98432: Linux Kernel TCP Flaw, Patch and Reboot

CVE-2026-98432 is a use-after-free bug in the Linux kernel code that sets up incoming IPv4 TCP connections. Published on 15 October 2026, it is scored 9.8 (Critical) on CVSS 3.1 by the Linux kernel CVE team, a severity score rather than a kernel version, and affects every kernel from Linux 4.4 until the fixed releases. An attacker needs no account and no user interaction, only a TCP port the server accepts connections on.

A use-after-free means the kernel keeps reading a piece of memory after it has already been handed back, which an attacker can use to leak data or take control.

Servers at risk include the Linux machines behind self-hosted Magento, WooCommerce and Laravel shops, because any TCP port they accept connections on is enough. This post lists the fixed kernel for each major distribution, how to check a server in three quick steps, and what to do if you cannot reboot today. It sits alongside our PHP2Shell post from October, which covers the PHP side of the same servers.

Which Linux kernel versions does the CVE-2026-98432 TCP vulnerability affect?

CVE-2026-98432 affects every Linux kernel from 4.4 onwards until it reaches the fixed release for its branch; kernels older than 4.4 are not affected. The CVE record lists no upstream fix for older branches such as 5.4, so servers on those need a distribution kernel that carries the backport, such as the 4.18 kernel in RHEL 8. The bug arrived with commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), which let the kernel process connection requests without holding the listener lock. The upstream fix is commit e3f33b0a1d89, merged for 7.3-rc7.

Source: the CVE-2026-98432 record published by the Linux kernel CVE team, and NVD, which shows the 9.8 score and lists the stable commits.

Is CVE-2026-98432 fixed on Ubuntu, Debian and RHEL?

Debian, Red Hat Enterprise Linux and AlmaLinux have CVE-2026-98432 fixes in their normal update channels; Ubuntu's 22.04, 24.04 and 26.04 LTS fixes are still in testing in -proposed. Install the version below or anything newer, then reboot. On Ubuntu, cloud and HWE kernels such as linux-aws, linux-azure, linux-gcp and linux-hwe carry their own version numbers, and the Ubuntu CVE page lists each one.

Red Hat also tracks the issue in its bulletin RHSB-2026-016, which says any Red Hat product that relies on the RHEL kernel, such as OpenStack Platform and Red Hat Virtualization, is potentially affected until its underlying kernel is updated.

Is CVE-2026-98432 being exploited?

CISA has not listed CVE-2026-98432 as exploited and Canonical said on 2 November that it knew of no published exploit, but a full remote root exploit exists. The CVE is not in the CISA Known Exploited Vulnerabilities catalogue (checked on 9 November 2026 against the catalogue released on 6 November).

• Anthropic found the bug and built the exploit with Claude. Its research post describes sending packets to a Linux server with a Multipath TCP (MPTCP) listener and running a shell command as root, with no credentials. In its proof of concept, leaking a kernel pointer took 48 minutes and reaching command execution took another five. Anthropic notes that a lost race only fails the handshake rather than crashing the machine, so an attacker can keep retrying.
• The exploit has not been released. Canonical calls it "yet-unreleased" and said on 2 November that no other exploit was known to have been generated or published.
• MPTCP is not required for the bug. Red Hat's bulletin says having MPTCP enabled is not a precondition, and that RHEL, which disables MPTCP by default, is still vulnerable.

How does the CVE-2026-98432 bug work?

CVE-2026-98432 is a race between two CPUs handling the same incoming connection, triggered by IPv4 options on the connection request. AlmaLinux's plain-English summary and the CVE description set out the sequence:

1. A connection request (a SYN packet) arrives carrying IPv4 options. The kernel keeps a copy of those options so it can echo them in its reply, the SYN-ACK.
2. When the handshake completes, that copy is handed to the new connection's socket without being duplicated.
3. If the client retransmits its SYN, another CPU can be building a SYN-ACK from the same options at that moment.
4. Nothing stopped the new socket being closed and freed in the meantime, and the kernel freed the options at once, so the code building the SYN-ACK read freed memory in ip_options_build().

A second path exists when TCP request socket migration is switched on (the net.ipv4.tcp_migrate_req sysctl, or a BPF program that migrates requests), which is off by default. The fix, written by Eric Dumazet, frees the options with kfree_rcu() so they are only released once no other CPU can still be reading them. IPv6 is not affected by the first path because the IPv6 code already copies the options.

Does CVE-2026-98432 affect Magento, WooCommerce, Laravel or Shopify stores?

It affects any store that runs on a Linux server you or your host manage; it does not change anything you need to do on a hosted platform like Shopify.

A WooCommerce or Magento server is a typical target: it accepts TCP connections from the whole internet on ports 80 and 443, and usually SSH on 22. The PHP version on the same machine is a separate question, covered in our PHP2Shell guide, and Magento stores should also check the PolyShell Magento vulnerability.

How do I check if my server is patched for CVE-2026-98432?

Three quick checks tell you which kernel is running and whether a fixed one is waiting for a reboot:

1. Show the running kernel. Run uname -r and compare the result with the fixed version for your distribution in the table above.
2. List installed kernels. On Debian and Ubuntu run dpkg -l 'linux-image*' | grep ^ii; on RHEL and AlmaLinux run rpm -q kernel. If a fixed kernel is installed but uname -r still shows an older one, the server needs a reboot.
3. Check the reboot flag on Ubuntu. The file /var/run/reboot-required exists when an installed update needs a restart. On other distributions, step 2 is the test.

How do I patch and reboot?

To patch CVE-2026-98432, update the kernel package with your distribution's package manager, reboot, then confirm with uname -r. Take a snapshot or backup first and pick a quiet hour, because the store is offline while the server restarts.

• Debian 12 and 13, and Ubuntu 26.10: sudo apt update && sudo apt full-upgrade, then sudo reboot.
• RHEL and AlmaLinux 8, 9 and 10: AlmaLinux gives sudo dnf clean metadata && sudo dnf upgrade, then sudo reboot.
• Ubuntu 22.04, 24.04 and 26.04: the fix reaches normal updates once Canonical finishes testing. If you cannot wait, Canonical's post gives the commands to install the kernel from -proposed; those packages are still under test, so try them on a staging server first. Until then, use the packet filter below.
• Laravel Forge servers: after the kernel update, reboot the server from the Forge dashboard or run sudo reboot over SSH. Once the server is back, check that Nginx, PHP-FPM, queue workers and scheduled jobs are running.

What is the CVE-2026-98432 mitigation if I cannot reboot today?

Until the fixed kernel is running, the CVE-2026-98432 stopgap is to drop incoming IPv4 TCP packets that carry IP options. Red Hat, Canonical and AlmaLinux all publish this mitigation, and Red Hat and Canonical both say it reduces the risk without removing it. Red Hat's bulletin gives this nftables table:

table inet cve_2026_98432 {
  chain input {
    type filter hook input priority -310; policy accept;
    ip protocol tcp ip hdrlength > 5 counter drop
  }
}

Save it as cve-2026-98432.nft, then check and apply it:

sudo nft --check --file cve-2026-98432.nft
sudo nft --file cve-2026-98432.nft

Things to know before you rely on it:

• It does not survive a reboot on its own. Red Hat says to reapply it after any reboot that happens before the kernel update. Canonical's CVE page shows how to include the file from /etc/nftables.conf so it loads at boot.
• It breaks connections that depend on IPv4 options. Red Hat says ordinary application traffic is generally expected to remain unaffected, because standard TCP options are carried in the TCP header, and Canonical lists timestamps and window scaling among the options that keep working. Test it against your own traffic first.
• Containers with their own network namespace need the rule applied separately, according to Canonical.
• Remove it once the fixed kernel is running with sudo nft delete table inet cve_2026_98432.

Two other ideas are circulating, and neither replaces the filter:

• Disabling MPTCP. sysctl -w net.mptcp.enabled=0 blocks the path Anthropic's exploit used, but Red Hat says it only blocks one method of exploitation. Go services are a special case: the Go team's notice says Go 1.24 and later enable MPTCP by default for listening sockets on Linux, and GODEBUG=multipathtcp=0 turns that off.
• The init_on_free=1 boot parameter. It was suggested in a post to the oss-security list on 31 October, and a CIQ kernel engineer replied on the list that it does nothing meaningful against this CVE, because the exploit leaks pointers from live memory rather than from the freed object.

What should I do about CVE-2026-98432 this week?

Check every Linux server you run with uname -r today, apply the packet filter where Ubuntu has not shipped a fix to -updates yet, and book the reboot for this week. October and November 2026 have produced security fixes at three layers of these servers: PHP, Node.js and now the kernel, so one maintenance window can cover all three.

If you run WooCommerce on your own servers and want help planning that maintenance window, talk to our WooCommerce development team. If the patching work is the reason you are weighing a hosted platform, our Magento to Shopify page sets out what moves and what changes.