Skip to content
securitytabs

Updated

Critical Linux kernel TCP flaw gets Red Hat fixes; Ubuntu patches still in testing

A serious flaw in how the Linux kernel handles network connections affects servers running Red Hat, Ubuntu and other Linux distributions. Red Hat has released fixes, so organizations running Linux servers should check whether their updates are in place.

Linux kernel TCP flaw fixed by Red Hat, Ubuntu pending
Linux kernel TCP flaw fixed by Red Hat, Ubuntu pending

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

A flaw in the Linux kernel's TCP networking code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL) and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS severity scale, and the NVD score is 9.8 as well. [1]

Anthropic said on October 27 that its AI model wrote an exploit for the flaw that lets a remote attacker with no credentials run commands as root on affected Linux servers. The SANS Internet Storm Center describes it as a remote code execution flaw in the kernel's Multipath TCP implementation. [1][2]

Patches

Fixed kernels are available for Red Hat Enterprise Linux 8, 9 and 10. Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel, with no date given for a regular update. [3]

About Multipath TCP

The SANS Internet Storm Center says Multipath TCP is an often-ignored TCP option introduced in 2020 and described in RFC 8684. It published a note on how to detect its use. [4][5]

Exploitation and what is not yet known

CISA does not list the flaw in its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, and its EPSS exploitation-likelihood score is 0.008. The cited coverage does not report attacks in the wild. [1][3]

Timeline

  1. Red Hat made fixed kernels available for RHEL 8, 9 and 10, while Ubuntu's fixes stayed in its testing channel. [3]

  2. The SANS Internet Storm Center published guidance on Multipath TCP use and detection. [4]

  3. The SANS Internet Storm Center highlighted the Multipath TCP code execution flaw in its daily briefing. [2]

  4. The kernel's CVE team rated the flaw 9.8 and distributions including Ubuntu and RHEL were named as affected. [1]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Small firms usually depend on a hosting or IT provider for Linux servers. Red Hat has fixes out; Ubuntu's are still in testing. No attacks have been reported in the sources. [1][3]

What to do

  1. Ask your hosting or IT provider whether its Linux servers are affected and whether kernel updates have been applied. [1][3]
  2. Ask whether your provider runs Ubuntu and, if so, when it will apply Ubuntu's fix. [3]

Mid-size company

A small IT or security team

What to know

Red Hat has released fixed kernels for RHEL 8, 9 and 10; Ubuntu's fixes are available only through its opt-in testing channel. [3]

What to do

  1. Identify Linux servers running RHEL or Ubuntu and apply Red Hat's fixed kernels where available. [3]
  2. Check whether Multipath TCP is in use on your servers, using the detection note from the SANS Internet Storm Center. [4]

Large enterprise

A security operations team

What to know

The flaw is rated 9.8 and an AI-written exploit has been described. No exploitation in the wild is reported in the sources. [1][2]

What to do

  1. Inventory Linux hosts across distributions, deploy Red Hat's fixed kernels and track Ubuntu's advisory for CVE-2026-98432. [3]
  2. Use the SANS guidance to detect Multipath TCP traffic and hosts where it is enabled. [4][5]

Sources

  1. [1]The Hacker News · Oct 29, 15:57 UTC
    Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributionscontext
  2. [2]SANS Internet Storm Center StormCast · Oct 30, 03:30 UTC
    SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaigncontext
  3. [3]The Hacker News · Nov 3, 11:23 UTC
    Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testingcontext
  4. [4]US-CERT / SANS Internet Storm Center · Nov 2, 14:52 UTC
    Mutipath TCP: Use and Detection, (Mon, Nov 2nd)context
  5. [5]SANS Internet Storm Center StormCast · Nov 3, 02:00 UTC
    SANS Stormcast Tuesday, November 3rd, 2026: Multipath TCP (MPTCP) Detection; BTCPay Server 2.4.1 Hot Wallet Thefts; Barracuda ESG Flaws (CVE-2026-116606, CVE-2026-111560); Synology DSM Ransomwarecontext