CVE-2026-98432 Critical Linux Kernel Flaw. Here’s what to know.

Key points

CVE-2026-98432 is a Linux kernel vulnerability with a CVSS 3.1 severity score of 9.8. It was first disclosed on October 15, 2026. As of October 31, 2026, there have been no public observations of exploitation nor release of working exploit code.

To read about N-able’s broader response to this vulnerability, check out our primary update on the topic and our Event Detail page on the N-able Uptime site.

This vulnerability affects the ways that the Linux kernel handles an IPv4 TCP handshake. Exploitation is believed to begin with an unauthenticated remote attacker sending a TCP SYN carrying IPv4 Record Route or Timestamp Options to a listening port. Given the right conditions, an attacker may retransmit this IPv4 TCP SYN, racing the teardown of the same connection, triggering a use-after-free that can leak exploitable information like kernel memory, corrupt it to achieve command execution as root, or cause a kernel panic or crash.

What N-able is doing

We are continuing to examine the nature of the vulnerability closely. Exploitation paths appear to be complex at the network layer, but converge at the Linux host level. Endpoint detection and response solutions are a key defense at that convergence point given their system-level hooks and visibility.

As a preemptive measure, the Adlumin MDR detection engineering and Nightscope Threat Research teams have implemented enhanced detection capabilities for unusual process executions running with root or without an associated user or service on Linux hosts. Adlumin MDR partners and clients can find this listed in the Adlumin MDR platform under the detection title “Unusual root process launched directly by kernel (possible kernel exploit)”.

This vulnerability will likely have other paths to exploitation that do not involve MPTCP, given that the IPv4 TCP path for Linux is not specific to MPTCP. Our teams will continue to track this topic as it develops, updating as more key details emerge.

Additional Background

Researchers at Anthropic shared that they achieved exploitation with a proof of concept, achieving root command execution that bypassed Kernel Address Space Layout Randomization (KASLR), a process that took roughly 53 minutes.

An additional factor is that Anthropic’s proof of concept is said to have exploited Linux servers with a multipath TCP listener configured (MPTCP). This is a relatively uncommon configuration for most Linux hosts. This feature allows a single TCP connection to use multiple network paths at the same time, allowing applications to use one ordinary TCP socket with the Linux kernel splitting the connection into several different paths, reassembling the data stream later.

What our partners should do

Apply Linux Kernel patches for affected systems as soon as possible. This remains the most effective control. Detection is not prevention.

Identify listeners where MPTCP is enabled and disable MPTCP, if possible. This removes the current known RCE path, but does not address the vulnerability.

Block inbound IPv4 packets carrying header options like “Record Route” and “Timestamp” at the network edge or on the host using capabilities like an nftables rule, if possible.

Note that Go-based listener services running on Go versions 1.24 and later enable MPTCP by default. Follow the Go Security Team’s guidance if this applies.

Restrict network access to Linux listeners to trusted sources where feasible.