CVE-2026-98432 is patched upstream and still missing from Ubuntu and Red Hat

The Linux kernel’s own CVE team scored CVE-2026-98432 at 9.8. The bug is a race in the code that sets up new IPv4 TCP connections, and it can leave the kernel using memory it has already freed. Upstream applied a fix on October 5, 2026, and the project says that fix has been carried into maintained stable branches. For almost everyone who runs a distribution, none of that matters until the vendor’s kernel package exists.

As of October 29, it does not exist for Ubuntu or for Red Hat Enterprise Linux. That is the operational fact. A high score is a sorting signal. A missing package is the work.

This briefing stops there on purpose. The conditions a researcher used to hit the race, and any demonstration of code execution, belong in the advisory and the research note. Copying them does not tell an operator whether the fleet is still exposed. The impact statement is enough. The kernel team says the bug could return nearby kernel memory to a remote party, corrupt kernel memory, or crash the system. IPv6 is outside this particular race. The bug dates to Linux 4.4.

The score depends on who is counting

The 9.8 was added to the CVE record on October 24, days after the identifier itself. The kernel team treats the race as low complexity. As of October 28, the National Vulnerability Database was still showing that score rather than a separate one. Ubuntu’s page shows it too, and Ubuntu marks the issue high priority.

Vendors who ship kernels have been more cautious, and they do not agree with each other or even with their own pages.

Red Hat’s CVE page has called the issue Moderate and scored it 5.9, on the view that the race is hard to win, that a crash is the likely result, and that an impact on confidentiality or integrity had not been demonstrated. Red Hat’s machine-readable advisory file, updated October 29, lists the impact as Important and the score as 8.1. The same day, Red Hat’s bug tracker moved the severity from medium to high. Oracle and SUSE also score it 8.1. Amazon scores it 7.0. The argument is mostly about how hard the race is to win, not about whether the bug is in the code.

Do not wait for the pages to converge. Install the package your vendor names. If your vendor has not shipped one, you are in the second group below, and a web score will not change that.

Who already has a kernel

Debian has. Trixie received linux 6.12.113-1 under DSA-6568-1 on October 16. Debian 12 has linux 6.1.190-1 and a 6.12 backport, linux-6.12 6.12.113-1~deb12u1. Oracle Linux’s UEK kernels for releases 7 through 10 are covered by ELSA-2026-500397, ELSA-2026-500398, and ELSA-2026-500399, dated October 16. On Amazon Linux 2023, the kernel6.18 package was fixed October 24 as kernel6.18-6.18.56-125.164.amzn2023. The kernel6.12 package, kernel6.12-6.12.113-138.209.amzn2023, is fixed in Amazon’s October 29 advisory even where the CVE page still said the fix was pending. SUSE Linux Micro 6.2 and openSUSE Leap 16.0 have kernel-default 6.12.0-160000.40.1 or later.

People who build their own kernels are on a different clock. The kernel CVE team points at the stable releases that contain the fix — 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3 — and says to move to the latest stable branch rather than lift a single patch. The project does not support cherry-picking.

Confirm the package the advisory names. A version string that looks new enough is not the check.

Who is still waiting

Ubuntu marks 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 as work in progress, and marks 16.04, 18.04, and 20.04 vulnerable with nothing released. Cloud, FIPS, and real-time kernels sit in the same bucket. Red Hat lists RHEL 8, 9, and 10, and OpenShift 4, with the fix deferred. RHEL 7 is not affected. Amazon Linux 2, and the main kernel package on Amazon Linux 2023, were still waiting. Parts of SUSE’s enterprise line, including SLES 15 SP7 and several long-term service branches, were in test or still in progress. Neither Ubuntu nor Red Hat has given a ship date.

Red Hat says it does not have a mitigation that is easy to deploy, fit for a typical installation, and stable. The other advisories do not list one either. Filtering a class of packets, or turning off an optional TCP feature, is not a workaround the public record has endorsed. Treat those ideas as untested.

A lab claim is not a field report

On October 27, Anthropic said one of its models had produced an exploit for this flaw. In that account, a remote attacker with no credentials could run commands as root on a Linux server that was listening for multipath TCP. The kernel fix credits Anthropic researcher Xinyang Ge with reporting the bug. The CVE record and the fix do not mention multipath TCP. That link comes from Anthropic’s post.

Read the claim at the size it was published. It is a description of a lab result, not a public proof-of-concept and not a report of intrusions. As of October 29, the advisories, the CVE record, and Anthropic’s post do not describe attacks using the flaw in the wild. It was absent from a copy of CISA’s Known Exploited Vulnerabilities catalog that CIRCL had updated on October 28.

Red Hat’s writing treats a reachable TCP service as enough for a remote party to try the race, and its CVE page still points at a crash as the likely outcome. Anthropic’s root-level result was described against a multipath TCP listener. The post does not say whether a host that never offered that feature can be taken over the same way. Those are different sentences. Do not collapse them into “every Linux box on the internet is already owned.” Do not collapse them into “this can wait, because it might only crash.” A remote crash of a kernel on a service you need is an outage. A claimed path to root is a patch-now item on any host you cannot take off the network.

Multipath TCP is not the default socket type. An application has to ask for it. That fact is useful when you inventory what you run. It is not a workaround any advisory has blessed.

What to do, in order

Install the fixed kernel where your distribution has published one, reboot into it, and confirm the package version the advisory names. That list today includes Debian, Oracle Linux UEK, parts of Amazon Linux 2023, and parts of SUSE.

Where the package does not exist yet — Ubuntu, RHEL, and the still-open Amazon and SUSE branches — write the host down and check the vendor advisory on a short cycle. Do not invent a sysctl from a thread.

Shrink who can open a TCP session to the machines that have to stay up in the meantime. Administrative services and forgotten listeners on a public address are the audience for a bug in the kernel’s TCP path. A firewall you already should have had is not a patch. It is how you spend the days until the patch ships.

Then look at images. An image baked this morning from an unfixed Ubuntu or RHEL base schedules the next fleet. Pin the rebuild to the advisory, whenever it lands.

This briefing describes the public impact of CVE-2026-98432 and which kernels to install. It does not include exploit details.