CVE-2026-98432: is your Linux server affected, and how to fix it

Do I need to worry?

Probably, if you look after a Linux machine that is reachable over the network. The attack happens while a connection is being set up, before your web server, SSH or app even sees it. Strong passwords and app updates don't help here. Only a kernel update fixes it.

Containers don't protect you. Every container on a host shares the host's kernel, so you patch the host, not the container.

Check your server in 3 steps

Run these on the server itself (over SSH is fine), not inside a container.

1. Find your distribution and kernel

   cat /etc/os-release | head -3
   uname -r

   Example output

   PRETTY_NAME="Ubuntu 24.04.3 LTS"
   NAME="Ubuntu"
   VERSION_ID="24.04"
   6.8.0-85-generic

   Write down the name and kernel version. You need them for the next step.

2. See if that kernel has the fix

   Distributions patch old version numbers instead of jumping to a new one, so compare against your distribution's fixed version, not the upstream one. Open the section for your system:

   Debian Fixed

   uname -v

   Example output

   #1 SMP PREEMPT_DYNAMIC Debian 6.1.190-1

   The number after “Debian” is the running package. You are patched at 6.1.190-1 or newer on Debian 12 (bookworm), or 6.12.113-1 or newer on Debian 13 (trixie). Source: Debian tracker.

   Ubuntu Not yet

   uname -r
   apt list --upgradable 2>/dev/null | grep linux-image

   On November 1, 2026, no Ubuntu release had a fix yet. Fixes were listed as in progress for 22.04, 24.04, 26.04 and 26.10. Watch the Ubuntu CVE page. When it shows “Released”, update and reboot.

   RHEL, AlmaLinux, Rocky, Oracle Linux Varies

   rpm -q --changelog kernel-core-$(uname -r) | grep -c CVE-2026-98432

   Example output

   0

   1 or more means the fix is in your running kernel. 0 means you're probably still vulnerable. To make sure the check itself works, run it again with CVE-20 instead. That should return a big number.

   AlmaLinux fixed versions: 4.18.0-553.180.2.el8_10, 5.14.0-687.61.2.el9_8, 6.12.0-211.69.2.el10_2 (advisory). Red Hat had no fixed kernel yet on November 1.

   SUSE / openSUSE Mostly fixed

   zypper patches --cve=CVE-2026-98432

   If the patch shows as needed, install it (see below). If it shows as applied, check that you've rebooted since.

3. See how exposed the machine is

   sudo ss -tlnp
   sudo ss -Mlnp
   sysctl net.mptcp.enabled

   Example output

   State  Recv-Q Send-Q Local Address:Port  Process
   LISTEN 0      4096         0.0.0.0:443  users:(("nginx",pid=812))
   LISTEN 0      128          0.0.0.0:22   users:(("sshd",pid=640))
   net.mptcp.enabled = 1

   The first command lists every service accepting TCP connections. The second lists Multipath TCP (MPTCP) listeners, which the published exploit targets. Any line there raises the risk.

   Running Go programs?

   Programs built with Go 1.24 or newer open MPTCP listeners automatically, according to the Go security team. They often show up in the second list even though nobody turned MPTCP on.

Patch status by distribution

Last checked November 1, 2026. Each distribution name links to its own tracker, which is the place to confirm, because this changes daily.

Upstream kernels with the fix: 7.3, 7.2.10, 6.18.56, 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272. These matter mainly if you build your own kernel.

Fix it: update and reboot

sudo apt update && sudo apt full-upgrade
sudo reboot

sudo dnf update 'kernel*'
sudo reboot

sudo dnf install -y almalinux-release-testing
sudo dnf update 'kernel*' --enablerepo=almalinux-testing
sudo reboot

# after the reboot, switch the testing repo off again
sudo dnf config-manager --disable almalinux-testing

sudo zypper patch --cve=CVE-2026-98432
sudo reboot

After the reboot, run step 2 again to confirm the new kernel is running. Managing several machines? Start with the ones reachable from the internet, then Kubernetes nodes and container hosts.

Can't patch yet? Temporary protection

Normal web traffic almost never uses IPv4 options, the rarely used header field that triggers the bug. Red Hat suggests a firewall rule that blocks TCP packets carrying them. It takes three steps:

1. Save the rule

   Create a file with this content:

   table inet cve_2026_98432 {
       chain input {
           type filter hook input priority -310; policy accept;
           ip protocol tcp ip hdrlength > 5 counter drop
       }
   }

2. Test and load it

   sudo nft --check --file cve-2026-98432.nft
   sudo nft --file cve-2026-98432.nft
   sudo nft list table inet cve_2026_98432

   No output from the first command means the file is valid. The last command shows the rule and a counter of blocked packets.

3. Remove it after patching

   sudo nft delete table inet cve_2026_98432

If nothing on the machine needs Multipath TCP, turn it off too, then restart any service still shown by ss -Mlnp:

echo 'net.mptcp.enabled = 0' | sudo tee /etc/sysctl.d/90-disable-mptcp.conf
sudo sysctl -w net.mptcp.enabled=0

FAQ

Technical details