Linux Kernel TCP Flaw CVE-2026-98432: Ubuntu Fix Status, the Risk, and What to Do Before the Patch

Updated November 3, 2026 · first published November 3, 2026

CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP code, rated CVSS 3 9.8 (Critical) on Ubuntu's page, which says it can lead to remote code execution. As of Ubuntu's page update on 3 November 2026, the 22.04, 24.04, 26.04 and 26.10 kernels are marked “work in progress” with no fixed package versions listed. Red Hat has reportedly patched.

Published 3 November 2026 · source: Ubuntu's CVE page (published 15 October, updated 3 November). Statuses change quickly; check the page before acting.

9.8

CVSS 3 score on Ubuntu's page

Critical

Ubuntu priority

4 of 4

current Ubuntu releases still in progress

fixed package versions listed on the page

What is the flaw?

Per Ubuntu's description, in the IPv4 TCP code ownership of ireq->ireq_opt passes to a child socket without a copy. A concurrent SYNACK can then read freed IP options, causing a use-after-free in ip_options_build(). Request socket migration has a similar problem. The upstream fix uses kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor(). The page says IPv6 is not affected by the first issue and that the IPv6 migration issue will be handled in a separate patch. Ubuntu's security team says the flaw can lead to remote code execution.

Which Ubuntu releases are affected?

Ubuntu release	Status on Ubuntu's page (3 Nov)	Kernel listed
26.10	Vulnerable, work in progress	7.3.0-10.10
26.04 LTS	Vulnerable, work in progress	7.0.0-43.43
24.04 LTS	Vulnerable, work in progress	6.8.0-149.149
22.04 LTS	Vulnerable, work in progress	5.15.0-203.213
20.04, 18.04, 16.04	Vulnerable	not stated
14.04 LTS	Not affected	not applicable

Cloud kernels such as linux-aws, linux-azure, linux-gcp and linux-oracle, and others such as linux-fips, are also listed as vulnerable or in progress. The page content we could read was truncated, so check your own kernel flavor. The page lists no release dates for patches.

What about the workaround?

The page carries a user-contributed nftables rule that drops incoming IPv4 TCP packets with IP options. The comment is attributed to a user, not to Ubuntu, and says it reduces the risk but does not fully prevent exploitation; it also breaks TCP connections that rely on IPv4 options. Treat it as a stopgap to test, not guidance. The Hacker News reports that Canonical says security updates are the only appropriate mitigation; we could not open that article, so this is secondary.

What should you do now?

List your hosts by kernel package and release. Include cloud-specific kernels and container hosts, since containers share the host kernel.
Check Ubuntu's page daily and install the kernel update the day it appears, then reboot or use live patching where your policy allows.
Reduce exposure meanwhile. Limit which networks can reach IPv4 TCP services on affected hosts, and test any packet filter before rollout.
Plan the reboot. A kernel fix needs a restart cycle across the fleet. See the cost of emergency patch downtime.
Watch GPU and inference hosts. A restart interrupts long jobs; see the cost clock on long-running agents for how to count it.

Frequently asked questions

What is CVE-2026-98432?

A use-after-free in the Linux kernel's IPv4 TCP code, where a concurrent SYNACK can read freed IP options. Ubuntu rates it Critical with a CVSS 3 score of 9.8 and says it can lead to remote code execution.

Has Ubuntu released a fix for CVE-2026-98432?

As of Ubuntu's page update on 3 November 2026, the 22.04, 24.04, 26.04 and 26.10 kernels were marked work in progress and no fixed package versions were listed. Check the page for the current status.

Is there a workaround before the patch?

Ubuntu's page carries a user-contributed nftables rule that drops incoming IPv4 TCP packets with IP options. It reduces risk but does not fully prevent exploitation and breaks connections that rely on IPv4 options. It is not official Ubuntu guidance.

Does disabling MPTCP fix it?

Ubuntu's page does not mention MPTCP. A secondary report says Canonical states the flaw is in the IPv4 TCP path, not MPTCP, and that security updates are the only appropriate mitigation.

Want this applied to your stack? Bring the provider bills, gateway logs, and top workflows; we will map the cost drivers and savings path. Book a free audit →

Back to finopsllm.com