Kernel TCP (CVE-2026-98432)

[nathany]

A new Linux kernel vulnerability, CVE-2026-98432, is a use-after-free in the code that sets up incoming IPv4 TCP connections. The Linux kernel CVE team scores it CVSS 9.8 (Critical), with a network attack vector and no privileges or user interaction required.

• Almalinux testing patch available - https://almalinux.org/blog/2026-10-30-cve-2026-98432/
• Debian patched 2 weeks ago
• Redhat, Cloudlinux and Ubuntu - still waiting for them to pull their fingers out

I can only say that with all the recent CVEs for the Kernel the Debian devs/maintainers have been doing a fantastic job of patching, think every time they have been the first to release by quite a margin. We are heavily Debian based but still have Almalinux and Cloudlinux, makes me think we should be revisiting those.

 

[Richard G]

We are heavily Debian based

I wonder what takes so long for Ubuntu then as that is also Debian based (Debian derative).

As far as the rest:

As of October 29, Ubuntu and RHEL have not released a fixed kernel. Red Hat, Amazon, Oracle, and SUSE score the flaw between 5.9 and 8.1, lower than the kernel team's 9.8.

And today, October 31, still nothing at least as far as RHEL goes.

Seems this can be temporarily more or less protected manually until the kernel fix. I read this on Facebook on a security page:

We applied a temporary mitigation on our clients' servers, with no reboot and no downtime. It drops IPv4 TCP packets that carry IP options. The exploit needs these options, and legitimate traffic practically never uses them.

But I don't know if this is correct and also don't know how to do this.

 

[Ohm J]

we are safe, it's off by default if your server are installed as clean OS not modify by your provider

$ sysctl net.mptcp.enabled
net.mptcp.enabled = 0
$ sysctl net.ipv4.tcp_migrate_req
net.ipv4.tcp_migrate_req = 0

Debian not safe

# sysctl net.ipv4.tcp_migrate_req
net.ipv4.tcp_migrate_req = 0
# sysctl net.mptcp.enabled
net.mptcp.enabled = 1

 

[hostpanel]

Just as precaution, i apply the follow rule on NFT.

echo 'net.ipv4.tcp_migrate_req = 0' | sudo tee /etc/sysctl.d/99-cve-2026-98432.conf
sysctl --system

sudo nft -f - <<'EOF'
add table ip cve_2026_98432
delete table ip cve_2026_98432
table ip cve_2026_98432 {
    chain prerouting {
        type filter hook prerouting priority -300; policy accept;
        meta l4proto tcp ip hdrlength > 5 counter drop
    }
}
EOF