{"id":91981,"date":"2026-10-31T18:46:43","date_gmt":"2026-10-31T18:46:43","guid":{"rendered":"https:\/\/www.n-able.com\/?p=91981"},"modified":"2026-10-31T18:46:43","modified_gmt":"2026-10-31T18:46:43","slug":"cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/it\/blog\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know","title":{"rendered":"CVE-2026-98432 Critical Linux Kernel Flaw. Here&#8217;s what to know."},"content":{"rendered":"<h2>Key points<\/h2>\n<p>CVE-2026-98432 is a Linux kernel vulnerability with a CVSS 3.1 severity score of 9.8. It was first disclosed on October 15, 2026. As of October 31, 2026, there have been no public observations of exploitation nor release of working exploit code.<\/p>\n<p><b>To read about N-able&#8217;s broader response to this vulnerability, check out <a href=\"https:\/\/www.n-able.com\/blog\/linux-vulnerability-important-update\">our primary update on the topic<\/a> and our <a href=\"https:\/\/uptime.n-able.com\/event\/202452\/\">Event Detail page<\/a> on the N-able Uptime site<\/b>.<\/p>\n<p>This vulnerability affects the ways that the Linux kernel handles an IPv4 TCP handshake. Exploitation is believed to begin with an unauthenticated remote attacker sending a TCP SYN carrying IPv4 Record Route or Timestamp Options to a listening port. Given the right conditions, an attacker may retransmit this IPv4 TCP SYN, racing the teardown of the same connection, triggering a use-after-free that can leak exploitable information like kernel memory, corrupt it to achieve command execution as root, or cause a kernel panic or crash.<\/p>\n<h2>What N-able is doing<\/h2>\n<p>We are continuing to examine the nature of the vulnerability closely. Exploitation paths appear to be complex at the network layer, but converge at the Linux host level. <b>Endpoint detection and response solutions are a key defense at that convergence point given their system-level hooks and visibility<\/b>.<\/p>\n<p>As a preemptive measure, the Adlumin MDR detection engineering and Nightscope Threat Research teams have implemented enhanced detection capabilities for unusual process executions running with root or without an associated user or service on Linux hosts. Adlumin MDR partners and clients can find this listed in the Adlumin MDR platform under the detection title &#8220;Unusual root process launched directly by kernel (possible kernel exploit)&#8221;. <\/p>\n<p>This vulnerability will likely have other paths to exploitation that do not involve MPTCP, given that the IPv4 TCP path for Linux is not specific to MPTCP. Our teams will continue to track this topic as it develops, updating as more key details emerge.<\/p>\n<h2>Additional Background<\/h2>\n<p><a href=\"https:\/\/www.anthropic.com\/research\/discovering-vulnerabilities-with-claude#:~:text=5.-,Zero%2Dclick%20remote%20code%20execution%20in%20Linux,-While%20this%20post\">Researchers at Anthropic shared<\/a> that they achieved exploitation with a proof of concept, achieving root command execution that bypassed Kernel Address Space Layout Randomization (KASLR), a process that took roughly 53 minutes.<\/p>\n<p>An additional factor is that Anthropic&#8217;s proof of concept is said to have exploited Linux servers with a multipath TCP listener configured (MPTCP). This is a relatively uncommon configuration for most Linux hosts. This feature allows a single TCP connection to use multiple network paths at the same time, allowing applications to use one ordinary TCP socket with the Linux kernel splitting the connection into several different paths, reassembling the data stream later.<\/p>\n<h2>What our partners should do<\/h2>\n<p>Apply Linux Kernel patches for affected systems as soon as possible. This remains the most effective control. <b>Detection is not prevention<\/b>.<\/p>\n<p>Identify listeners where MPTCP is enabled and disable MPTCP, if possible. This removes the current known RCE path, but does not address the vulnerability.<\/p>\n<p>Block inbound IPv4 packets carrying header options like &#8220;Record Route&#8221; and &#8220;Timestamp&#8221; at the network edge or on the host using capabilities like an nftables rule, if possible.<\/p>\n<p>Note that Go-based listener services running on Go versions 1.24 and later enable MPTCP by default. Follow the <a href=\"https:\/\/groups.google.com\/g\/golang-announce\/c\/PCoQcdxoScw\/m\/aD-MgXEvAAAJ\">Go Security Team&#8217;s guidance<\/a> if this applies.<\/p>\n<p>Restrict network access to Linux listeners to trusted sources where feasible. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Key points CVE-2026-98432 is a Linux kernel vulnerability with a CVSS 3.1 severity score of 9.8. It was first disclosed on October 15, 2026. As of October 31, 2026, there&#8230;<\/p>\n","protected":false},"author":140,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"class_list":["post-91981","post","type-post","status-publish","format-standard","hentry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.8 (Yoast SEO v28.8) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>CVE-2026-98432 Critical Linux Kernel Flaw. Here&#039;s what to know. - N-able<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.n-able.com\/it\/blog\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know\" \/>\n<meta property=\"og:locale\" content=\"it_IT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CVE-2026-98432 Critical Linux Kernel Flaw. Here&#039;s what to know. - N-able\" \/>\n<meta property=\"og:description\" content=\"Key points CVE-2026-98432 is a Linux kernel vulnerability with a CVSS 3.1 severity score of 9.8. It was first disclosed on October 15, 2026. As of October 31, 2026, there...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.n-able.com\/it\/blog\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know\" \/>\n<meta property=\"og:site_name\" content=\"N-able\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/ThisIsNable\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-31T18:46:43+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/03\/share-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"N-able Nightscope Threat Research Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Nable\" \/>\n<meta name=\"twitter:site\" content=\"@Nable\" \/>\n<meta name=\"twitter:label1\" content=\"Scritto da\" \/>\n\t<meta name=\"twitter:data1\" content=\"N-able Nightscope Threat Research Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tempo di lettura stimato\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minuti\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/blog\\\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/blog\\\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know\"},\"author\":{\"name\":\"N-able Nightscope Threat Research Team\",\"@id\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/#\\\/schema\\\/person\\\/a77a9ca3df135d23033a04135d83f745\"},\"headline\":\"CVE-2026-98432 Critical Linux Kernel Flaw. Here&#8217;s what to know.\",\"datePublished\":\"2026-10-31T18:46:43+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/blog\\\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know\"},\"wordCount\":541,\"publisher\":{\"@id\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/#organization\"},\"inLanguage\":\"it-IT\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/blog\\\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know\",\"url\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/blog\\\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know\",\"name\":\"CVE-2026-98432 Critical Linux Kernel Flaw. Here's what to know. - N-able\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/#website\"},\"datePublished\":\"2026-10-31T18:46:43+00:00\",\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.n-able.com\\\/it\\\/blog\\\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/#website\",\"url\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/\",\"name\":\"N-able\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"it-IT\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/#organization\",\"name\":\"N-able\",\"url\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.n-able.com\\\/wp-content\\\/uploads\\\/2021\\\/02\\\/logo-n-able-vertical-dark.svg\",\"contentUrl\":\"https:\\\/\\\/www.n-able.com\\\/wp-content\\\/uploads\\\/2021\\\/02\\\/logo-n-able-vertical-dark.svg\",\"width\":\"1024\",\"height\":\"1024\",\"caption\":\"N-able\"},\"image\":{\"@id\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/ThisIsNable\",\"https:\\\/\\\/x.com\\\/Nable\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/n-able\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UClnp77HHg4aME-S-3fWQhFw\"],\"description\":\"N-able helps organizations achieve business resilience through an AI-powered cybersecurity platform that brings together a portfolio of integrated IT management, security, and data protection solutions, helping reduce risk and strengthen resilience across prevention, detection, response, and recovery.\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.n-able.com\\\/it\\\/#\\\/schema\\\/person\\\/a77a9ca3df135d23033a04135d83f745\",\"name\":\"N-able Nightscope Threat Research Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/06c618510fb042163253dc2e87ceaa19b3c101e0574d62262940cf8b7f01af4c?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/06c618510fb042163253dc2e87ceaa19b3c101e0574d62262940cf8b7f01af4c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/06c618510fb042163253dc2e87ceaa19b3c101e0574d62262940cf8b7f01af4c?s=96&d=mm&r=g\",\"caption\":\"N-able Nightscope Threat Research Team\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"CVE-2026-98432 Critical Linux Kernel Flaw. Here's what to know. - N-able","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.n-able.com\/it\/blog\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know","og_locale":"it_IT","og_type":"article","og_title":"CVE-2026-98432 Critical Linux Kernel Flaw. Here's what to know. - N-able","og_description":"Key points CVE-2026-98432 is a Linux kernel vulnerability with a CVSS 3.1 severity score of 9.8. It was first disclosed on October 15, 2026. As of October 31, 2026, there...","og_url":"https:\/\/www.n-able.com\/it\/blog\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know","og_site_name":"N-able","article_publisher":"https:\/\/www.facebook.com\/ThisIsNable","article_published_time":"2026-10-31T18:46:43+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/03\/share-image.jpg","type":"image\/jpeg"}],"author":"N-able Nightscope Threat Research Team","twitter_card":"summary_large_image","twitter_creator":"@Nable","twitter_site":"@Nable","twitter_misc":{"Scritto da":"N-able Nightscope Threat Research Team","Tempo di lettura stimato":"3 minuti"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.n-able.com\/it\/blog\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know#article","isPartOf":{"@id":"https:\/\/www.n-able.com\/it\/blog\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know"},"author":{"name":"N-able Nightscope Threat Research Team","@id":"https:\/\/www.n-able.com\/it\/#\/schema\/person\/a77a9ca3df135d23033a04135d83f745"},"headline":"CVE-2026-98432 Critical Linux Kernel Flaw. Here&#8217;s what to know.","datePublished":"2026-10-31T18:46:43+00:00","mainEntityOfPage":{"@id":"https:\/\/www.n-able.com\/it\/blog\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know"},"wordCount":541,"publisher":{"@id":"https:\/\/www.n-able.com\/it\/#organization"},"inLanguage":"it-IT"},{"@type":"WebPage","@id":"https:\/\/www.n-able.com\/it\/blog\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know","url":"https:\/\/www.n-able.com\/it\/blog\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know","name":"CVE-2026-98432 Critical Linux Kernel Flaw. Here's what to know. - N-able","isPartOf":{"@id":"https:\/\/www.n-able.com\/it\/#website"},"datePublished":"2026-10-31T18:46:43+00:00","inLanguage":"it-IT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.n-able.com\/it\/blog\/cve-2026-98432-critical-linux-kernel-flaw-heres-what-to-know"]}]},{"@type":"WebSite","@id":"https:\/\/www.n-able.com\/it\/#website","url":"https:\/\/www.n-able.com\/it\/","name":"N-able","description":"","publisher":{"@id":"https:\/\/www.n-able.com\/it\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.n-able.com\/it\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"it-IT"},{"@type":"Organization","@id":"https:\/\/www.n-able.com\/it\/#organization","name":"N-able","url":"https:\/\/www.n-able.com\/it\/","logo":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.n-able.com\/it\/#\/schema\/logo\/image\/","url":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","contentUrl":"https:\/\/www.n-able.com\/wp-content\/uploads\/2021\/02\/logo-n-able-vertical-dark.svg","width":"1024","height":"1024","caption":"N-able"},"image":{"@id":"https:\/\/www.n-able.com\/it\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/ThisIsNable","https:\/\/x.com\/Nable","https:\/\/www.linkedin.com\/company\/n-able","https:\/\/www.youtube.com\/channel\/UClnp77HHg4aME-S-3fWQhFw"],"description":"N-able helps organizations achieve business resilience through an AI-powered cybersecurity platform that brings together a portfolio of integrated IT management, security, and data protection solutions, helping reduce risk and strengthen resilience across prevention, detection, response, and recovery."},{"@type":"Person","@id":"https:\/\/www.n-able.com\/it\/#\/schema\/person\/a77a9ca3df135d23033a04135d83f745","name":"N-able Nightscope Threat Research Team","image":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/secure.gravatar.com\/avatar\/06c618510fb042163253dc2e87ceaa19b3c101e0574d62262940cf8b7f01af4c?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/06c618510fb042163253dc2e87ceaa19b3c101e0574d62262940cf8b7f01af4c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/06c618510fb042163253dc2e87ceaa19b3c101e0574d62262940cf8b7f01af4c?s=96&d=mm&r=g","caption":"N-able Nightscope Threat Research Team"}}]}},"_links":{"self":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/posts\/91981","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/users\/140"}],"replies":[{"embeddable":true,"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/comments?post=91981"}],"version-history":[{"count":0,"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/posts\/91981\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.n-able.com\/it\/wp-json\/wp\/v2\/media?parent=91981"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}