The short version
- CVE-2026-98432 is a critical use-after-free flaw in the Linux kernel affecting Multipath TCP (MPTCP) servers.
- The vulnerability allows for remote root access and has been assigned a maximum CVSS score of 9.8.
- Major enterprise distributions including Red Hat Enterprise Linux and Ubuntu currently lack available fixes.
A critical security vulnerability in the Linux kernel, identified as CVE-2026-98432, has emerged as a significant threat to internet infrastructure. The flaw resides within the Transmission Control Protocol (TCP) implementation and specifically affects systems utilizing Multipath TCP (MPTCP). Security researchers have classified the issue as a use-after-free error, a type of memory corruption bug that can allow attackers to execute arbitrary code with root privileges on affected servers.
The severity of the defect is underscored by its Common Vulnerability Scoring System (CVSS) rating of 9.8, the highest possible score. This rating indicates that the vulnerability is easily exploitable and requires no user interaction for successful compromise. Reports indicate that the flaw enables remote root attacks on MPTCP servers, potentially granting attackers complete control over compromised systems without needing local access or credentials.
Despite the critical nature of the bug, major Linux distributions have not yet provided patches. According to recent reporting, neither Red Hat Enterprise Linux (RHEL) nor Ubuntu has released a fix for CVE-2026-98432 as of late October 2026. This delay leaves millions of servers running these popular enterprise and consumer distributions exposed to potential exploitation. The absence of immediate remediation options has heightened concern among system administrators and security professionals.
The vulnerability affects a broad range of Linux-based systems, extending beyond just RHEL and Ubuntu to include other distributions that rely on the affected kernel versions. MPTCP is an extension of TCP that allows data to be sent over multiple paths simultaneously, improving reliability and performance. While beneficial for network efficiency, its implementation in the kernel has introduced this critical attack surface.
Security firms such as Rescana and Cyber Kendra have highlighted the ongoing risk posed by the unpatched status of major platforms. The Hacker News also reported on the widespread impact, noting that the flaw affects a wide array of distributions. The consensus among security analysts is that any server running MPTCP with an unpatched kernel is at immediate risk.
The technical mechanism behind the vulnerability involves improper handling of memory resources within the TCP stack. Use-after-free errors occur when a program continues to use memory after it has been freed, leading to unpredictable behavior and potential code execution. In this case, attackers can manipulate network traffic to trigger the bug, gaining elevated privileges on the host system.
System administrators are advised to assess their exposure by checking whether MPTCP is enabled on their servers. If MPTCP is not required for specific operations, disabling it may mitigate the risk until patches become available. However, for systems that depend on MPTCP for performance or redundancy, there are currently no software-based mitigations provided by distribution vendors.
The timeline for patch release remains uncertain. While kernel developers are likely working on a fix, the delay in distribution-level updates suggests that exposure may persist for weeks or months. This window of vulnerability is particularly concerning given the ease of exploitation and the high severity rating.
As organizations await official patches, monitoring network traffic for anomalous activity associated with MPTCP exploitation attempts is recommended. The incident serves as a reminder of the risks inherent in complex kernel features and the importance of timely security updates.
Further developments will depend on when major vendors release their patches and whether evidence of active exploitation emerges in the wild. Until then, the Linux community faces a significant challenge in securing its infrastructure against this critical flaw.
Sources behind this briefing
Go to the original reporting
- Rescana↗Linux Kernel CVE-2026-98432: Critical TCP Use-After-Free, No RHEL or Ubuntu Fix Yet
- The Hacker News↗Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
- BleepingComputer↗Critical Linux kernel flaw allows remote root attacks on MPTCP servers
- Cyber Kendra↗Critical Linux Kernel TCP Flaw CVE-2026-98432 Still Unpatched on Ubuntu and RHEL
