Ubuntu has rolled out early kernel patches for CVE-2026-98432, a vulnerability in the Linux kernel that allows unauthenticated remote attackers to execute code as root without any user interaction. Fixes are currently in the “-proposed” repositories for Ubuntu 22.04 LTS (Jammy) and later releases; several older versions remain unprotected as of now.
What’s the Flaw?
The vulnerability is rooted in how the Linux kernel handles IPv4 TCP connections, specifically involving a use-after-free condition when IP options are freed on one CPU while being accessed on another during the processing of SYN packets. The upstream resolution uses kfree_rcu() to defer freeing memory until it’s safe. Ubuntu assigns a CVSS score of 9.8 for the bug, labeling it Critical, though separate documentation refers to it as High. The issue impacts kernel versions from 4.4 onward. Trusty (14.04) is unaffected; Xenial (16.04), Bionic (18.04), and Focal (20.04) are still awaiting patches. Patched builds include 5.15.0-203.213 for Jammy; 6.8.0-149.149 for Noble (24.04); 7.0.0-43.43 for Resolute (26.04); and 7.3.0-10.10 for Stonking (26.10). A formal disclosure happened in mid-October, and detailed exploit demonstrations were publicized between late October and early November.
Exploits & Scanning in the Wild
Security researchers observed threat actors conducting internet‐wide scans targeting servers running multipath TCP (MPTCP) listeners, probing port 443 with non-standard TCP/IP behavior. Some scans found over two million reachable hosts via MPTCP, with about 760,000 responding to TLS probes. These indicators suggest attackers are fishing for systems vulnerable to CVE-2026-98432, though no fully weaponized public exploit is confirmed yet. Lab work by an AI model revealed a two-stage exploit, one step leaking a kernel pointer to bypass address space layout randomization (KASLR), followed by overwriting a callback pointer to execute a root shell. The exploit takes advantage of the exposure from open MPTCP sockets.
What System Administrators Should Do
Administrators are urged to check their kernel version via uname -r and compare it to the fixed versions listed above. Those running Jammy, Noble, Resolute, or Stonking can install the proposed-stage upgrades and then reboot. Ubuntu is testing the fixes in “-proposed” before wider rollout. For systems that can’t update immediately, a suggested mitigation is to deploy an nftables rule to drop incoming IPv4 TCP packets with IP options, though this may disrupt services relying on such options and does not completely block the exploit path.
Ubuntu Pro is required for Extended Security Maintenance: Focal (20.04) and earlier versions fall under paid tiers unless they qualify under free allowances. Extended or Legacy support offerings are in place for older releases.
Why this matters, and what’s next: CVE-2026-98432 is a wake-up call that critical vulnerabilities in core networking code can go from theory to mass scanning in a very short timeframe. Admins must determine whether their systems are vulnerable, take immediate mitigation steps, and prepare for full updates. In addition to patching, monitoring incoming traffic for unusual MPTCP probing could provide early warning signs. The longer servers remain unpatched, the greater the window for attackers to adapt this exploit into serious breach tools that bypass existing defenses.
