CVE-2026-98432 Linux Kernel Vulnerability: Critical IPv4/TCP Flaw Requires an Update
The CVE-2026-98432 vulnerability in Linux kernel network processing is remotely accessible without authentication. AWS has released fixed packages for Amazon Linux 2 and 2023.
The CVE-2026-98432 vulnerability affects the processing of incoming IPv4 TCP connections in the Linux kernel. It is a use-after-free flaw that can be reached remotely without authentication. Servers accepting IPv4 TCP connections are most directly exposed, so operators should prioritize checking the status of their kernel security updates.
The vulnerability is in the kernel’s network path, before a specific application takes over the connection. It therefore does not affect only one type of server software, but potentially a broad range of publicly accessible services running on Linux.
CVE-2026-98432 Vulnerability: Assessment and Demonstrated Attack
The Linux kernel CVE record lists a CVSS v3.1 score of 9.8 for the flaw. Ubuntu rates it at 8.3 under CVSS v4.0. The difference shows that the resulting severity assessment varies according to the model used and the specific deployment.
Anthropic stated that, in a controlled environment, it demonstrated remote command execution with root privileges on a server with an MPTCP listener. The vulnerability is therefore not merely a theoretical memory-corruption issue.
However, the published information does not confirm active exploitation against real-world targets. It is also unclear under what conditions remote code execution can be reproduced outside the demonstrated environment. Success may depend mainly on the MPTCP configuration and the precise timing of concurrent requests.
Kernel Fix and Temporary Exposure Reduction
The upstream fix is available as commit e3f33b0a1d89. AWS has released fixed kernel packages for Amazon Linux 2 and Amazon Linux 2023. A system restart is required after the update to boot the fixed kernel.
As a temporary measure, Red Hat recommends filtering incoming IPv4 TCP packets with IP options. This filtering is not a replacement for a kernel update and should be tested against the specific network traffic before deployment.
- Check the security advisory and the availability of a fixed kernel for the distribution or cloud image in use.
- Update the kernel and schedule a restart of affected systems.
- If an update is not yet possible, consider filtering IPv4 packets with IP options after testing.
- Give priority to publicly accessible servers accepting IPv4 TCP connections.
What to Watch Next
The availability of fixes and the scope of impact are still changing across distributions and cloud services. Operators should monitor advisories from RHEL, Ubuntu, Debian and SUSE, as well as updates to cloud images and services. Trusted confirmation of any in-the-wild exploitation will also be important, along with clarification of the conditions under which the flaw leads to remote code execution rather than a system crash or memory corruption.
Sources
- Anthropic Research – Anthropic describes its controlled proof of remote command execution as root through CVE-2026-98432 and states that the fix was backported to maintained stable branches.
- Red Hat Customer Portal – Red Hat confirms a critical use-after-free flaw in IPv4/TCP, remote attack without authentication, and temporary filtering of IPv4 packets with IP options.
- Ubuntu Security – Ubuntu lists the upstream e3f33b0 fix and different CVSS v3.1 and v4.0 assessments.
- AWS Security Bulletin – AWS confirms the availability of fixed kernel packages for Amazon Linux and the need to restart after the update.
- AlmaLinux OS – AlmaLinux describes the affected path involving IPv4 options, the flaw’s origin in Linux 4.4, and test fixed kernels.
Verified and updated: 11/01/2026 15:48
