New Linux Vulnerability With No Official Update Yet on Ubuntu and Red Hat: Temporary Steps to Protect Your Company's Servers Until the Fix Arrives

CVE-2026-98432 is a flaw in how the Linux kernel accepts TCP connection requests. It lets a remote attacker, with no password, crash the server or corrupt kernel memory. The Linux kernel CVE team rates it 9.8 out of 10, and Anthropic says its Claude model wrote an exploit that gives an attacker root on servers that accept MPTCP connections. The fix is in the upstream kernel and Debian has shipped it, but as of October 30, 2026 Ubuntu lists it as "work in progress" for 22.04, 24.04 and 26.04, and Red Hat lists RHEL 8, 9 and 10 as affected with no update. Until the update lands: disable MPTCP if you do not need it, block IPv4 packets carrying IP options, restrict who can reach your servers, and schedule the reboot.

What is CVE-2026-98432, and why does it matter to your company?

According to the official CVE record, the flaw sits at the moment an IPv4 TCP handshake completes: the kernel hands the IP options stored with the connection request to the new connection without copying them, while another CPU may at that same moment process a duplicate request and build a reply from those options. If the kernel frees the memory first, it then reads it after freeing it, a bug known as use-after-free. The flaw has existed since kernel 4.4. The kernel CVE team published it on October 15, 2026 and scored it 9.8 out of 10 because it is reachable over the network, during the handshake and before any login, with no user interaction.

In a post on October 27, Anthropic said Claude wrote an exploit that lets a remote attacker with no credentials run commands as root on Linux servers that accept MPTCP, or multipath TCP, connections. In its test the exploit took 48 minutes to leak an address from kernel memory, then 5 minutes to reach command execution. Worse, a failed attempt does not crash the server; only that connection fails, so an attacker can keep retrying without anyone noticing. Anthropic did not publish the exploit itself.

Red Hat describes the main impact as a server crash and denial of service, with possible memory corruption. As of the October 30 release of CISA's Known Exploited Vulnerabilities catalog, the flaw had not been added to it.

Has an update reached your distribution?

This is the status shown on each distribution's official page on October 30, 2026:

Upstream, the fix shipped in versions 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. But most servers run their distribution's kernel, so what counts is your distribution's page, not the upstream version number.

How do you know whether a server is exposed?

Run these commands on every Linux server that accepts connections from the internet:

uname -r
cat /proc/sys/net/mptcp/enabled
ss -Mln
cat /proc/sys/net/ipv4/tcp_migrate_req

• The first prints the kernel version; compare it with your distribution's page. On Ubuntu 24.04, for example, every version available today is unfixed.
• A value of 1 from the second means MPTCP is enabled, which is the default according to the kernel documentation.
• The third lists services that accept MPTCP connections. Any service that shows up is the kind of target Anthropic exploited. Watch Go programs: according to the Go 1.24 release notes, their listeners now use MPTCP by default where it is supported.
• The fourth should print 0; the flaw's second path only works when it is 1, according to the CVE record.

The temporary fix until the update arrives: 5 steps

1. If your distribution has the fix, install it now and reboot. On Debian 12 and 13, for example:

   sudo apt update && sudo apt upgrade
   sudo reboot

   The new kernel does not protect you until the server is running it.
2. Disable MPTCP if no service needs it. This closes the kind of target Anthropic exploited:

   sudo sysctl -w net.mptcp.enabled=0
   echo "net.mptcp.enabled = 0" | sudo tee /etc/sysctl.d/99-disable-mptcp.conf

   The first command applies the setting at once; the second keeps it after a reboot. The kernel documentation says the setting is per network namespace, so apply it inside containers too. Go programs fall back automatically to plain TCP when MPTCP is not available. But neither Anthropic nor any distribution says disabling it removes the flaw itself, so it narrows the risk rather than curing it.
3. Block TCP packets that carry IPv4 options. The scoring scenario in the CVE record assumes an attacker who sends a connection request carrying the IPv4 Record Route or Timestamp option, and ordinary web, mail and SSH traffic does not need those options. Ask your network administrator for a firewall rule that drops inbound TCP packets whose IPv4 header is longer than 20 bytes, and test it on one server first. No distribution says this blocks the flaw, but it removes the condition the scoring assumes.
4. Restrict who can reach your servers. The flaw needs an open TCP port that accepts connections, so close every port you do not need, and keep SSH and admin panels reachable only from specific IP addresses or over a VPN. If the site sits behind an intermediary such as a CDN, let the origin server accept connections only from that service's addresses.
5. Prepare the update before it arrives. Follow the Ubuntu and Red Hat pages for this CVE, pre-approve the kernel update and set a reboot window, so the fix goes in the day it ships. Watch the kernel log for crashes that mention ip_options_build:

   sudo journalctl -k | grep -i ip_options_build

   A quiet log does not mean safety, though, because a failed attempt does not crash the server.

What if your servers sit with a hosting provider?

On shared hosting and managed services, the kernel belongs to the provider, not to you. Ask three questions: which distribution and kernel version its servers run, when it will install the fix, and what it is doing to reduce the risk until then. A virtual private server (VPS) usually leaves the kernel in your hands, so apply the steps above yourself.

Origami's view

As in our article on PHP vulnerabilities, when the official update is late, temporary steps are what protect servers in the first days. They narrow the risk, though; the only cure is the fixed kernel after a reboot. At Origami we can check your Linux servers, apply the temporary steps without disrupting your services, and install the fix as soon as it ships. Contact us.

Key takeaways

• CVE-2026-98432 is a Linux kernel flaw rated 9.8 out of 10 by the kernel team, attacking the server remotely during the TCP handshake, before any login.
• Debian has shipped the fix; Ubuntu and Red Hat had not as of October 30, 2026.
• Until they do: disable MPTCP if you do not need it, block TCP packets with IPv4 options, and close ports you do not use.
• Install the fixed kernel as soon as it ships and reboot; the temporary steps are no substitute for it.

Sources

• CVE.org: CVE-2026-98432 record
• Ubuntu: CVE-2026-98432 status
• Red Hat: CVE-2026-98432
• Debian Security Tracker: CVE-2026-98432
• Anthropic: Discovering and exploiting vulnerabilities with Claude, October 27, 2026
• CISA: Known Exploited Vulnerabilities catalog
• Linux kernel documentation: MPTCP sysctl variables
• Go 1.24 release notes
• Go: ListenConfig.SetMultipathTCP