Linux kernel vulnerability CVE-2026-98432: unauthenticated remote root, kernels to install

The short answer: CVE-2026-98432 is a critical flaw in the IPv4 TCP code of the Linux kernel, present since version 4.4. It can allow a remote attacker, without authentication or any user action, to run commands as root. Morocco’s maCERT (DGSSI) flagged it on 30 October 2026. No exploitation is confirmed so far, but fixes are arriving distribution by distribution: install the fixed kernel, reboot, then check the kernel actually running.

In Morocco, this alert affects a large share of business servers: web servers, Odoo hosting, Proxmox hypervisors, cloud machines and Linux-based appliances.

What is affected and what to install

Product	Affected versions	Fixed version
Official Linux kernel	from 4.4	5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3
Debian 12 (Bookworm)	6.1 kernel before the fix	6.1.190-1 (DLA-4841-1); for linux-6.12: 6.12.113-1~deb12u1 (DLA-4850-1)
Debian 13 (Trixie)	6.12 kernel before the fix	6.12.113-1 (DSA-6568-1)
Red Hat Enterprise Linux 8, 9, 10	kernels before the fixes; RHEL 6 and 7 not affected	RHSA-2026:93414 and 93415 (RHEL 8), RHSA-2026:93412 (RHEL 9), RHSA-2026:93413 (RHEL 10)
Ubuntu 22.04, 24.04, 26.04, 26.10	listed as “vulnerable, work in progress” on 5 November	announced: 5.15.0-203.213, 6.8.0-149.149, 7.0.0-43.43, 7.3.0-10.10
Proxmox VE, 7.0 kernel	7.0.14-24-pve and earlier	7.0.14-25-pve and later
Amazon Linux 2 and 2023	kernel families listed by AWS	packages shown as fixed in the AWS tracker

Sources: the Linux kernel CVE record, the Debian, Red Hat, Ubuntu and Amazon security trackers, and the official Proxmox forum. These statuses change daily: check your distribution’s tracker before acting. For Proxmox, any other kernel branch should be checked in the package changelog or with support.

Technically, this is a use-after-free. While a TCP connection is being set up, IPv4 options can be freed while another CPU is still reading them, for example to answer a retransmitted SYN. The kernel fix delays that release. IPv6 is not affected by the first scenario described in the CVE record.

Severity and exploitation

• Published severity: the Linux kernel CVE record and Red Hat give a CVSS 3.1 score of 9.8 (critical). Amazon uses 8.1 (important) and Oracle Linux rates it “important”.
• maCERT: bulletin 70343010/26 of 30 October 2026 rates both risk and impact as critical. It refers readers to each distribution’s bulletins.
• Exploitation: none confirmed. CVE-2026-98432 is not in the CISA KEV catalog of 4 November 2026. The Fortinet advisory states “Known Exploited: No” and Sophos says it is not aware of any public exploitation.
• Proof of feasibility: according to BleepingComputer and CSO Online, Anthropic reports that an unreleased Claude research model wrote, in a lab, an exploit giving remote root on a server with an MPTCP listener, in about 53 minutes. The code has not been published.
• Signal to watch: Aikido relays a report from researcher Marcus Hutchins of what looks like internet scanning for MPTCP servers. This is not proof of attacks, but it is a reason not to wait.

The appliance question: Fortinet, Sophos and others

On 2 November 2026, Fortinet published advisory FG-IR-26-188: its investigation is ongoing and the list of products under review includes FortiOS, FortiManager, FortiAnalyzer, FortiMail, FortiWeb, FortiSwitch and FortiAP. At this stage the advisory confirms neither an affected product nor a fixed version, and it announces no virtual patch. So do not conclude that your FortiGates are vulnerable: follow the advisory and our FortiOS upgrade method.

Sophos also published an advisory on 2 November, saying it is investigating its products, and it asks customers to include Linux-based third-party appliances in their inventory. Do the same for your NAS devices, IP PBXs and security appliances: ask each vendor for its fix status.

Interim measures

If the fixed kernel is not yet available, or the reboot has to be scheduled:

1. Reduce exposure: limit TCP ports reachable from the internet to the services you need, and to trusted addresses where possible.
2. Filter IPv4 TCP packets carrying IP options. Red Hat publishes the nftables rule below. It reduces exposure without eliminating it and may disrupt some workloads: test it first. It does not survive a reboot.

table inet cve_2026_98432 {
  chain input {
    type filter hook input priority -310; policy accept;
    ip protocol tcp ip hdrlength > 5 counter drop
  }
}

Save it as cve-2026-98432.nft, validate with sudo nft --check --file cve-2026-98432.nft, and apply with sudo nft --file cve-2026-98432.nft. Once the fixed kernel is running, remove it with sudo nft delete table inet cve_2026_98432.

3. Do not rely on disabling MPTCP alone. According to Red Hat, net.mptcp.enabled=0 blocks one exploitation method, not the flaw. RHEL disables MPTCP by default and remains vulnerable.

Checks to run

• Inventory all Linux hosts: virtual machines, Proxmox nodes, cloud servers, containers and their hosts, forgotten machines.
• Check the running kernel with uname -r after the reboot. A kernel that is installed but not loaded fixes nothing.
• Compare it with your distribution’s version, not the official kernel version, because fixes are backported.
• Start with internet-facing servers.
• Watch for unexplained reboots and kernel crashes, which the CVE record lists as a possible consequence. If in doubt, apply our incident response plan for the first hour.

What this means for businesses in Morocco

This flaw is a reminder that an updated server is not necessarily a protected one: without a reboot, the fix stays inactive. On a hypervisor, that means moving or stopping virtual machines, so the work has to be prepared. Our patch management method helps organise this kind of campaign. For the organisations concerned, Law 05-20 and DGSSI requirements also require maCERT bulletins to be acted on.

How we can help

We can list your Linux servers, compare their kernels with the fixed versions, set up the interim filter if needed and schedule the reboots. On your clusters, we work as a Proxmox partner in Morocco, with our Proxmox integration and support offer. For your firewalls, we follow the vendor’s advisory as a Fortinet integrator in Morocco. We then provide 24/7 monitoring, with critical incidents handled in under 15 minutes.

Discover our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.

Sources: maCERT bulletin 70343010/26, CVE-2026-98432 record, NVD CVE-2026-98432, Red Hat RHSB-2026-016, Debian tracker, Ubuntu tracker, Amazon Linux tracker, Oracle Linux, Proxmox forum, Fortinet advisory FG-IR-26-188, Sophos advisory, CISA KEV catalog, BleepingComputer, CSO Online, Aikido.