CVE-2026-98432: Ubuntu TCP fix not in security updates yet

Linux distributions have shipped kernel fixes for CVE-2026-98432, a flaw in the kernel's IPv4 TCP code that a remote attacker can reach without logging in. On Ubuntu, though, the fixed kernels sit in the -updates channel and not yet in -security, a Tech AI Wire check of the package mirrors found on November 9, 2026. A server that installs only automatic security updates is still running a vulnerable kernel.

Ubuntu's CVE tracker rates the bug Critical, with a CVSS score of 9.8 out of 10. The record was published on October 15 and updated on November 9. Linux 4.4 and every later kernel are affected, according to Cyber Security News. Ubuntu 14.04 is not.

What the Linux TCP bug does

When a server accepts a new IPv4 TCP connection, the kernel hands the connection's IP options to the new socket without copying them. IP options are rarely used extra fields in a packet's header. If the client resends its opening packet while another processor core reads those options, the kernel can read memory it has already freed. That class of bug is called a use-after-free, and it can lead to code running inside the kernel.

The upstream fix, titled "ipv4: free inet_opt and ireq_opt after an RCU grace period," waits until no reader is using the memory before freeing it. IPv6 is not affected on the main path, Amazon's advisory says.

On October 27, Anthropic said an unreleased Claude research model had written a working remote root exploit. It targets Linux servers with a Multipath TCP (MPTCP) listener, a feature that lets one connection use several network paths, The Hacker News reports. The exploit has not been published. CloudLinux says "Our kernel team couldn't reproduce that claim."

Red Hat and Canonical both say MPTCP is not the flaw itself, so turning it off is not a fix. No vendor has confirmed attacks. Researcher Marcus Hutchins reported suspected scanning on port 443 from November 2, Cyber Security News says.

Fixed kernels by distribution, checked November 9

Tech AI Wire queried each distribution's own package mirror from fresh containers on macOS 26.6 with Docker Desktop 28.4.0. Each run used apt-cache policy or dnf list --showduplicates, then searched the kernel package's changelog for the fix. Red Hat's advisory numbers come from The Hacker News, and Amazon's from its security center.

Distribution	First fixed kernel	On the mirror, November 9	Changelog names the fix
Ubuntu 26.04 LTS	7.0.0-43.43	resolute-updates only; -security has 7.0.0-42.42	Yes
Ubuntu 24.04 LTS	6.8.0-149.149	noble-updates only; -security has 6.8.0-147.147	Yes
Ubuntu 22.04 LTS	5.15.0-203.213	jammy-updates only; -security has a 5.15.0-202 build	Yes
Ubuntu 20.04, 18.04, 16.04	Not released	Fix in progress, per Ubuntu's tracker	Not tested
Debian 13	6.12.113-1 (October 15)	6.12.116-1 in trixie-security	Yes, with the CVE
Debian 12	6.1.190-1 (October 16)	6.1.190-1 in bookworm-security	Yes, with the CVE
RHEL 10.2	6.12.0-211.72.1 (RHSA-2026:93413)	AlmaLinux 10 has 211.74.1	Yes, with the CVE
RHEL 9.8	5.14.0-687.64.1 (RHSA-2026:93412)	AlmaLinux 9 has 687.66.1	Yes, with the CVE
RHEL 8.10	4.18.0-553.182.1 (RHSA-2026:93414)	AlmaLinux 8 has 553.184.1	Yes, with the CVE
Amazon Linux 2023	ALAS2023-2026-3365, October 30	kernel 6.1.189-236.400	No CVEs listed

Ubuntu 26.10 is already marked fixed in 7.3.0-10.10 on Ubuntu's tracker. The 22.04 and 24.04 pockets looked the same on arm64 and amd64.

Why Ubuntu auto-updates miss the fix

Ubuntu ships the unattended-upgrades package to install updates without a person. In the same test, its default file /etc/apt/apt.conf.d/50unattended-upgrades on 22.04 and 24.04 allowed -security and the ESM channels. The -updates line was commented out: // "${distro_id}:${distro_codename}-updates";.

So a default Ubuntu server will not pick up 6.8.0-149 or 5.15.0-203 until Canonical copies them to -security. On November 9, the tracker still marked 22.04, 24.04 and 26.04 "Vulnerable," with the fixed versions listed as "work in progress." A manual upgrade does pick it up: in the test, apt's own candidate for linux-image-generic was already the -updates build.

The test also showed a trap for container users. Ubuntu, Debian, Amazon Linux, AlmaLinux and Alpine containers all reported the same kernel, 6.10.14-linuxkit, which belongs to Docker Desktop's own virtual machine. Containers share their host's kernel, so a rebuilt image changes nothing.

What this means for developers

Run uname -r on every Linux host you manage and compare it with the table. On Ubuntu 22.04, 24.04 and 26.04, install the kernel from -updates now rather than waiting for auto-updates, then reboot. The Ubuntu Security Team "believes that security updates are the only appropriate mitigation," The Hacker News quotes.

The reboot is required everywhere, because the running kernel stays in memory until then. Livepatch services such as KernelCare can patch a running kernel instead, CloudLinux says.

For Kubernetes and Docker hosts, patch the nodes, not the images. Amazon's EKS-optimized images from v20261031 carry the fix, and new Fargate tasks after November 1 run on a patched platform, Aikido reports.

Red Hat published a firewall rule that drops IPv4 TCP packets carrying IP options. It may break software that uses those options, and Red Hat says it cannot fully prevent an attack. Treat it as a stopgap for hosts that cannot reboot today.

Kernel fixes have come quickly this fall: in October, six Infinity Core flaws arrived with public exploits. Watch Ubuntu's tracker for the move to -security and a USN, Ubuntu's security notice.