If you run Linux servers that accept connections from the internet, install your distribution's kernel update for CVE-2026-98432 as soon as it is available, then reboot. Debian has fixes out. As of Nov. 4, 2026, Ubuntu's fixes were in its testing (-proposed) pocket, not yet in regular updates, and Red Hat's were still "being expedited".

What is new this week

  • Oct. 27: Anthropic's Frontier Red Team published a write-up describing an exploit for this bug, written with an unreleased internal research model. It says the exploit lets a remote attacker send packets to a Linux server with a multipath TCP (MPTCP) listener and run commands as root, with no credentials or user interaction. Anthropic says the bug was patched upstream and backported to all maintained stable kernel branches.
  • Oct. 29: the Go Security Team told Go users to upgrade the kernel (posted to oss-security on Oct. 30) and explained why Go programs matter here.
  • Nov. 2: Canonical said fixes for Ubuntu 22.04, 24.04 and 26.04 were in the -proposed pocket.
  • By Nov. 4: Debian lists fixed kernels. Red Hat rates the issue Critical and has not released fixes yet.

No source we checked claims the bug is being exploited in the wild.

What the bug is

The CVE record describes a use-after-free in the kernel's IPv4 TCP code. The kernel.org CNA scores it CVSS 3.1 9.8 (Critical), per the NVD, and Canonical says it affects kernel 4.4 and later. When a connection is being set up, one CPU can free a socket's IP options while another CPU, handling a retransmitted connection request, is still reading them. The fix frees that memory only after an RCU grace period (kfree_rcu()). A similar problem exists when request sockets are migrated between listeners, which applies if tcp_migrate_req=1 or a BPF reuseport migrate program is in use. IPv6 is not affected by the first issue.

Anthropic says a lost race only fails the handshake rather than crashing the system, so an attacker can retry. In its proof of concept, leaking a kernel pointer took 48 minutes and reaching command execution took five more.

Linux kernel update status, Nov. 4

  • Debian: fixed. The security tracker lists DSA-6568-1 (trixie) and DLA-4841-1 and DLA-4850-1 (bookworm). Fixed versions are 6.1.190-1 (bookworm) and 6.12.115-2 (trixie security). Install the update and reboot.
  • Red Hat: RHSB-2026-016 says unauthenticated remote code execution is possible and fixes are being expedited. As of our check at noon ET on Nov. 4, none had shipped. It describes an nftables rule that drops IPv4 TCP packets carrying IP options. Red Hat says that reduces exposure but does not fully prevent the bug, is lost on reboot, and should be tested first.
  • Ubuntu: Canonical's Nov. 2 post says fixes are in the -proposed pocket for 22.04 (5.15.0-203.213), 24.04 (6.8.0-149.149) and 26.04 (7.0.0-43.43), and 26.10 is fixed in 7.3.0-10.10. 16.04, 18.04 and 20.04 are pending, and 14.04 is not affected. The fixes are not yet in the regular updates pocket, and -proposed packages are not installed by default, so a normal apt upgrade will not bring them in.
  • RHEL and derivatives: no fix yet. Follow the Red Hat bulletin above.
  • Others: check your vendor's advisory.

Is turning off MPTCP enough?

No. Anthropic's demonstration used an MPTCP listener, but the Go team says the bug is not specific to MPTCP and systems without MPTCP listeners may be open to similar attacks. Red Hat says disabling MPTCP is not a complete mitigation and notes that RHEL, which disables MPTCP by default, is still vulnerable.

Go matters because, since Go 1.24, Go programs enable MPTCP by default for listening sockets on Linux. Setting GODEBUG=multipathtcp=0 or godebug multipathtcp=0 in go.mod turns that off, and code can override it per socket. The Go team calls per-program disabling "a fragile mitigation" and says upgrading the kernel is the best fix.

What to do: check your servers

These are checks, not fixes.

  1. Kernel version: run uname -r for the running kernel, and dpkg -l 'linux-image*' | grep ^ii (Debian or Ubuntu) for the installed package, then compare both with your distribution's advisory. Installed and running versions differ until you reboot.
  2. Pending updates (Debian or Ubuntu): run sudo apt update, then apt list --upgradable 2>/dev/null | grep linux-image.
  3. MPTCP listeners: ss -M -l lists listening MPTCP sockets, and sysctl net.mptcp.enabled shows whether MPTCP is on. Go services built with 1.24 or later may be listening this way without anyone choosing it. No MPTCP listener, or net.mptcp.enabled=0, does not mean the host is safe: Red Hat says RHEL defaults to off and is still vulnerable.
  4. Exposure: the risk is highest for hosts that take inbound TCP connections from the internet. Desktop and home users should simply take the normal distro update.

A kernel update only takes effect after a reboot, so schedule one. Until your vendor ships a fix, the Red Hat rule above and firewalling services you do not need are stopgaps.

Why it matters

A bug in the TCP stack reaches almost every networked service, which is why Red Hat calls the surface broad. For other recent patch-now stories, see GitLab's critical flaw and the Node.js Brotli flaw.