Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Ubuntu tests a fix for a Linux kernel flaw rated 9.8

Part of the CVE-2026-98432 story · since 28 Oct

Developinglatest 2 hours ago9 articles4 outlets
28 Oct · The Hacker News first1 Nov2 NovNowThis article9th of 9
  • Wed 28 Oct, 09:02 UTC. The Hacker News, first report. Anthropic AI model chains flaws into browser and OS exploits.
  • Wed 28 Oct, 18:01 UTC. SecurityOnline, its first report on the story. Anthropic’s AI research uncovers flaws across major platforms.
  • Thu 29 Oct, 17:30 UTC. The Hacker News. Linux TCP flaw rated 9.8 puts Ubuntu and Red Hat at risk.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Linux kernel flaw could give attackers remote root access.
  • Sun 1 Nov, 17:03 UTC. cybersixt, its first report on the story. CVSS 9.8 Linux flaw lets attackers take root on Go servers by default.
  • Mon 2 Nov, 15:30 UTC. SANS ISC, its first report on the story. SANS details detection of Linux Multipath TCP vulnerability.
  • Mon 2 Nov, 19:30 UTC. The Hacker News. FBI blames North Korean TraderTraitor for $6.43 billion heist.
  • Tue 3 Nov, 03:30 UTC. SecurityOnline. Arista patches two flaws that risk remote code execution.
  • Tue 3 Nov, 10:30 UTC. SecurityOnline. Ubuntu tests a fix for a Linux kernel flaw rated 9.8. This article, 9th of 9.

CVE-2026-98432, a Linux kernel TCP flaw with a CVSS of 9.8, has been addressed in Ubuntu’s -proposed pocket for 22.04 LTS and newer. The issue lies in how the kernel sets up IPv4 TCP connections, and the bug has existed in kernels from version 4.4 onwards. Canonical notes the defect is a use-after-free race that can lead to remote code execution.

The fixes are currently in testing in the -proposed pocket, with upstream patches already merged into stable kernels including 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10. Evidence cited includes a description from Anthropic researcher Xinyang Ge of a yet-unreleased exploit linked to Multipath TCP (MPTCP), while Canonical’s Luci Stanescu adds that no other published exploit is known. No exploitation in the wild has been reported as of the article’s publication.

The kernel fix hinges on how tcp_v4_syn_recv_sock() hands saved IPv4 options to a new socket without copying, potentially allowing another CPU to read those options during a retransmitted SYN. The remedy is to free the options only after an RCU grace period. Affected Ubuntu releases include 22.04 (5.15.0-203.213), 24.04 (6.8.0-149.149) and 26.04 (7.0.0-43.43) in -proposed; Ubuntu 26.10 (7.3.0-10.10) is shown as fixed, with fixes pending for 16.04, 18.04 and 20.04, and 14.04 not affected.

Upstream, the patch is present in stable kernels listed above. Administrators are advised to install the -proposed builds and reboot, checking with uname -r to verify the running kernel.

How the story developed

All 9 articles
Developinglatest 2 hours ago9 articles4 outlets

9 articles from 4 outlets since 28 Oct. Picked up again on 1 Nov after 2 days quiet. This was the 9th report, 6 days after the first.

Now28 Oct29302 Nov3First reportThe Hacker News · 28 Oct, 09:02This article9th of 9 · day 6Picked up againafter 2 days quiet
  • Wed 28 Oct, 09:02 UTC. The Hacker News, first report. Anthropic AI model chains flaws into browser and OS exploits.
  • Wed 28 Oct, 18:01 UTC. SecurityOnline, its first report on the story. Anthropic’s AI research uncovers flaws across major platforms.
  • Thu 29 Oct, 17:30 UTC. The Hacker News. Linux TCP flaw rated 9.8 puts Ubuntu and Red Hat at risk.
  • Fri 30 Oct, 09:00 UTC. SecurityOnline. Linux kernel flaw could give attackers remote root access.
  • Sun 1 Nov, 17:03 UTC. cybersixt, its first report on the story. CVSS 9.8 Linux flaw lets attackers take root on Go servers by default.
  • Mon 2 Nov, 15:30 UTC. SANS ISC, its first report on the story. SANS details detection of Linux Multipath TCP vulnerability.
  • Mon 2 Nov, 19:30 UTC. The Hacker News. FBI blames North Korean TraderTraitor for $6.43 billion heist.
  • Tue 3 Nov, 03:30 UTC. SecurityOnline. Arista patches two flaws that risk remote code execution.
  • Tue 3 Nov, 10:30 UTC. SecurityOnline. Ubuntu tests a fix for a Linux kernel flaw rated 9.8. This article, 9th of 9.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Wed 28 OctDay 02
    1. Anthropic AI model chains flaws into browser and OS exploits09:02 · The Hacker News · First report
    2. Anthropic’s AI research uncovers flaws across major platforms18:01 · SecurityOnline
  2. Thu 29 OctDay 11
    1. Linux TCP flaw rated 9.8 puts Ubuntu and Red Hat at risk17:30 · The Hacker News
  3. Fri 30 OctDay 21
    1. Linux kernel flaw could give attackers remote root access09:00 · SecurityOnline

  4. Quiet for 2 days

    Sun 1 NovDay 41
    1. CVSS 9.8 Linux flaw lets attackers take root on Go servers by default17:03 · cybersixt · Picked up again
  5. Mon 2 NovDay 52
    1. SANS details detection of Linux Multipath TCP vulnerability15:30 · SANS ISC
    2. FBI blames North Korean TraderTraitor for $6.43 billion heist19:30 · The Hacker News
  6. Tue 3 NovDay 62
    1. Arista patches two flaws that risk remote code execution03:30 · SecurityOnline
    2. Ubuntu tests a fix for a Linux kernel flaw rated 9.810:30 · SecurityOnline · This article, 9th of 9

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in