CVE-2026-98432: Linux TCP Exposure, Kernel Fixes and Recovery

Linux is the operating-system kernel that manages processes, hardware and networking on servers and container hosts. Its TCP networking code establishes the connections used by web services, SSH and databases. CVE-2026-98432 affects that connection-handling code: the kernel can free memory containing IPv4 options while another operation still reads it. The upstream fix credits Anthropic researcher Xinyang Ge with reporting the flaw.

On October 27, 2026, Anthropic published research reporting a demonstration that ran commands as root—the administrator account—on a Linux server accepting multipath TCP connections. The demonstration required no credentials or user interaction. Multipath TCP, or MPTCP, lets a connection use multiple network paths. The result matters because it reaches the kernel before an application can ask for a password.

The affected scope is broader than that demonstration. In its October 30 bulletin, Red Hat identifies systems running vulnerable kernels with IPv4 TCP enabled, particularly those accepting incoming connections. It lists RHEL 8, 9, 10 and OpenShift among affected products. The Go Security Team's October 29 notice explains why Go services deserve attention: Go 1.24 introduced MPTCP listeners by default on Linux. It also warns that the underlying bug is not specific to MPTCP.

These findings establish a serious remote-code-execution risk and a reported laboratory exploit. They do not establish confirmed attacks in the wild, reliable exploitation of every distribution, or compromise of any particular host. A server that has not crashed is not thereby cleared. Patch availability, the kernel actually running and application recovery are separate questions.

What changed during October

The upstream patch submission linked from the fix is dated October 1. Ubuntu records CVE publication on October 15. Anthropic's October 27 account then described the demonstrated impact. Go's October 29 notice clarified listener defaults, followed by Red Hat's Critical bulletin on October 30.

Atlas's follow-up report, first published October 29, was updated October 31 at 17:15 CDT, or 22:15 UTC. That update brought distribution patch developments and Go exposure into focus. Those are separate questions: an upstream fix can exist while a distribution is still preparing its own supported packages.

The memory error is a use-after-free: one operation releases memory before another has finished using it. Here, concurrent TCP connection processing can leave an operation reading saved IPv4 options after their memory has been released. The upstream patch delays freeing that memory until existing readers have finished. This fixes the memory lifetime rather than changing application authentication.

Why Go's MPTCP defaults matter

Go's GODEBUG documentation records the Go 1.24 default as multipathtcp=2: enable MPTCP for listeners, but not dialers. A listener accepts incoming connections; a dialer starts outgoing ones. Kernel support, application configuration and network reachability still determine whether a particular service exposes an MPTCP listener.

A program's compatibility settings can affect its defaults. Programs can also explicitly enable or disable MPTCP for individual sockets. This means the Go toolchain version alone does not establish how a deployed service accepts connections. The demonstrated MPTCP path is important, but it does not define the full scope of the kernel flaw.

How to check affected hosts and verify recovery

For Linux servers and container hosts, the following checks separate exposure, the active kernel fix and service recovery. They help document maintenance and find failures. They do not prove that a host was never exploited.

Check Go listener settings and temporary mitigations

For deployed Go services, check the program's compatibility settings, runtime environment and socket configuration. In particular, inspect whether the application uses net.ListenConfig.SetMultipathTCP. Explicit socket settings override the GODEBUG default.

The Go Security Team documents GODEBUG=multipathtcp=0 as a way to disable MPTCP by default. Changing this setting changes application behavior; assess it with the service owner and verify the resulting listeners.

Application-by-application disabling is fragile. A missed listener remains exposed, explicit socket settings can override the default, and other exploits might not require MPTCP. Treat this as a possible temporary measure, not as a replacement for a fixed kernel.

Match the host to its vendor advisory

Begin on the host operating system, not only inside an application container. These read-only commands record the running kernel release and distribution identity:

uname -r
cat /etc/os-release

A container normally shares its host's kernel. Updating packages inside the container does not replace that kernel. For managed nodes or virtual appliances, use the provider's advisory and maintenance procedure to identify who controls the kernel update.

Record the distribution release, architecture, kernel flavor and installed kernel package. Then match those details to the vendor's CVE entry and security advisory. Cloud, hardware-enablement and real-time kernels may have different package names and release schedules.

The following is a dated snapshot checked on November 1, 2026. Reopen the linked trackers before choosing an update.

Sources: Debian security tracker, Ubuntu CVE tracker, and Red Hat bulletin.

Debian's numbers above are source-package versions, not strings to compare directly with uname -r. Distribution maintainers also backport fixes into older kernel lines. A numerically older upstream version can contain the fix; a package installation record cannot show whether that package is running.

If a supported fix is not yet available, follow the vendor's current mitigation advice and test its effect on necessary traffic. Red Hat says its traffic filtering can reduce exposure but cannot fully prevent exploitation. Avoid treating a firewall change as a completed patch.

Verify the running kernel after maintenance

Before changing the host, retain its identity, running release and the applicable advisory. Follow the distribution or provider procedure to install and activate the supported fix. Plan for service interruption and preserve relevant evidence if compromise is suspected.

After the planned restart, run uname -r again on that same host. Match the result to the vendor's fixed binary package. Keep the advisory identifier and package-to-release mapping with the maintenance record. If your provider uses live patching, require explicit coverage for this CVE and evidence that the patch is active; a running live-patch agent alone is insufficient.

On systemd hosts, this read-only command lists boots represented in the accessible journal:

journalctl --list-boots --no-pager

The boot identifiers and timestamps help locate the maintenance restart. They do not verify CVE coverage. Missing older boots can reflect retention or access limits. See the journalctl manual for boot selection and journal access details.

Check service recovery in retained logs

Read a short interval spanning shutdown, startup and the first successful application activity. For example, on a systemd host with a service named checkout-api.service:

journalctl --unit=checkout-api.service \
  --since='2026-11-01 02:00:00 UTC' \
  --until='2026-11-01 02:20:00 UTC' \
  --utc --output=short-iso --no-pager

Replace the unit and times with the actual service and maintenance window. The time boundaries are inclusive. These options are available in systemd 217 and later. The command reads accessible retained records without restarting the service. Protect exported logs because application messages can contain sensitive data. The journalctl manual documents the filters and output options.

A service-only query omits other evidence. Review retained kernel and boot records separately for startup or device failures. Check collection gaps around the restart, including whether local journals survived it. System logging in Linux explains how journald and forwarding affect which records remain available.

The following is a synthetic timeline, not real incident evidence or guaranteed command output. It combines maintenance, application and monitoring records:

2026-11-01T02:01:00Z host=edge-07 source=maintenance event=restart_started
2026-11-01T02:04:12Z host=edge-07 service=checkout-api event=start_failed reason="required config file missing"
2026-11-01T02:08:30Z host=edge-07 source=maintenance event=config_file_restored
2026-11-01T02:09:02Z host=edge-07 service=checkout-api event=ready
2026-11-01T02:10:15Z host=edge-07 source=external_monitor event=read_check_ok

The startup error explains why the application remained unavailable after the host returned. The later readiness and external check support recovery, but cover different things. Readiness reflects the application's own assessment. An external check tests a reachable service path. Verify the necessary dependencies and normal request success over a suitable observation period as well. Do not replay payments or other writes merely to test recovery.

None of these rows proves the kernel is fixed. Nor does an empty error search exclude exploitation. If independent evidence suggests unauthorized access, preserve the relevant records and investigate that separately from routine recovery. How to read logs covers narrowing a timeline without treating missing events as proof.

Review the same window in Fluxtail

If host and service logs were already collected into Fluxtail, open their stream and select the maintenance interval. Narrow to the host and service using fields your collector actually preserves. Inspect the raw startup, error and recovery rows, then compare their times with the maintenance record and independent health checks.

Keep host-level events in view as well: filtering only to the application can hide a boot failure or a collection interruption. Check that records arrived on both sides of the restart before interpreting a quiet interval. Central collection cannot recover events that were never sent.

Fluxtail's log management supports reviewing collected evidence in one place. It does not verify kernel patch coverage or establish whether CVE-2026-98432 was exploited.

Keep three separate findings in the final maintenance record: the vendor fix applicable to the host, evidence that the fixed kernel is active, and evidence that required services work. Record any missing evidence explicitly so another operator can see what still needs checking.