--- title: Linux kernel TCP RCE vulnerability (CVE-2026-98432): fix description: CVE-2026-98432 is a critical flaw in how the Linux kernel sets up IPv4 TCP connections, affecting kernel 4.4 and later, rated 9.8 out of 10. Anthropic says an... canonical: https://daily.dev/posts/linux-kernel-tcp-rce-vulnerability-cve-2026-98432-fix-fdat9aa4c twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Linux kernel TCP RCE vulnerability (CVE-2026-98432): fix | daily.dev og:description: CVE-2026-98432 is a critical flaw in how the Linux kernel sets up IPv4 TCP connections, affecting kernel 4.4 and later, rated 9.8 out of 10. Anthropic says an... og:url: https://daily.dev/posts/linux-kernel-tcp-rce-vulnerability-cve-2026-98432-fix-fdat9aa4c og:image: https://api.daily.dev/og/posts/fdAt9aa4c.png og:image:alt: Linux kernel TCP RCE vulnerability (CVE-2026-98432): fix og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Linux kernel TCP RCE vulnerability (CVE-2026-98432): fix **[Aikido Security](https://daily.dev/sources/aikido-security)** · 8 min read · 0 upvotes · 0 comments ## Summary CVE-2026-98432 is a critical flaw in how the Linux kernel sets up IPv4 TCP connections, affecting kernel 4.4 and later, rated 9.8 out of 10. Anthropic says an unreleased Claude research model wrote an exploit giving remote root on a Linux server with an MPTCP listener, no credentials needed. In its test, leaking a kernel address took 48 minutes and getting command execution took 5 more. CloudLinux says it couldn't reproduce the claim. Go programs since Go 1.24 request MPTCP by default, widening exposure. Ubuntu and Red Hat had no patched kernel as of October 30; fixes landed upstream in versions like 5.10.272 and 6.12.113. The fix: patch and reboot. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-98432 and which Linux kernel versions are affected? CVE-2026-98432 is a use-after-free vulnerability in how the Linux kernel handles IP options during a TCP handshake, specifically in tcp_v4_syn_recv_sock() and ip_options_build(). It affects Linux kernel 4.4 and later. The kernel CVE team rates it 9.8 out of 10. The bug was introduced in kernel 4.4, fixed upstream on October 5, and published as a CVE on October 15. _Teams triaging this kernel flaw can track patch status across distros with daily.dev._ ### How do I mitigate CVE-2026-98432 if my vendor hasn't released a patched kernel yet Disable MPTCP by setting net.mptcp.enabled=0, or for Go 1.24+ programs set GODEBUG=multipathtcp=0, since the demonstrated exploit required an MPTCP listener. Also drop IPv4 packets carrying IP options with an iptables rule AWS provides, or put the host behind a load balancer that terminates TCP before reaching the kernel. None of these fully fix the bug; only a patched kernel and reboot do. _Developers managing exposed Go servers can keep up with kernel CVE mitigations like this on daily.dev._ ### Why would a Go server be vulnerable to the Linux MPTCP exploit even if I never configured MPTCP Since Go 1.24, Go programs request multipath TCP by default for the sockets they listen on, according to the Go Security Team. If the underlying Linux kernel allows MPTCP, which some distributions like AlmaLinux and CloudLinux disable by default but many others allow, a Go server can become an MPTCP listener without anyone deliberately choosing it, exposing it to the demonstrated exploit. _Go developers deciding how to patch production servers can follow kernel and runtime advisories on daily.dev._ ## Similar posts on daily.dev - [Eight stable kernels with fix for a single vulnerability](https://daily.dev/posts/eight-stable-kernels-with-fix-for-a-single-vulnerability-fwk63qgar) · LWN.net · 0 upvotes · 0 comments - [PinTheft Linux kernel vulnerability mitigation](https://daily.dev/posts/pintheft-linux-kernel-vulnerability-mitigation-89zunv5we) · Ubuntu · 0 upvotes · 0 comments - [Meet Fragnesia, the third Linux kernel vulnerability in a month](https://daily.dev/posts/meet-fragnesia-the-third-linux-kernel-vulnerability-in-a-month-bcgeuj59z) · CSO Online · 3 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/linux-kernel-tcp-rce-vulnerability-cve-2026-98432-fix-fdat9aa4c) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Linux kernel TCP RCE vulnerability (CVE-2026-98432): fix","url":"https://daily.dev/posts/linux-kernel-tcp-rce-vulnerability-cve-2026-98432-fix-fdat9aa4c","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/linux-kernel-tcp-rce-vulnerability-cve-2026-98432-fix-fdat9aa4c"},"datePublished":"2026-11-02T09:50:34.943Z","dateModified":"2026-11-02T15:38:46.009Z","description":"CVE-2026-98432 is a critical flaw in how the Linux kernel sets up IPv4 TCP connections, affecting kernel 4.4 and later, rated 9.8 out of 10. Anthropic says an...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/32c92ccb7b07c1094d0c7b98c851a17f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/32c92ccb7b07c1094d0c7b98c851a17f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Aikido Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aikido Security","logo":"https://media.daily.dev/image/upload/s--vJDqDYv_--/f_auto,q_auto/v1774959928/logos/aikido-security?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aikido-security"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/linux-kernel-tcp-rce-vulnerability-cve-2026-98432-fix-fdat9aa4c","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,linux","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aikido Security","item":"https://daily.dev/sources/aikido-security"},{"@type":"ListItem","position":3,"name":"Linux kernel TCP RCE vulnerability (CVE-2026-98432): fix"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/linux-kernel-tcp-rce-vulnerability-cve-2026-98432-fix-fdat9aa4c#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-98432 and which Linux kernel versions are affected?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-98432 is a use-after-free vulnerability in how the Linux kernel handles IP options during a TCP handshake, specifically in tcp_v4_syn_recv_sock() and ip_options_build(). It affects Linux kernel 4.4 and later. The kernel CVE team rates it 9.8 out of 10. The bug was introduced in kernel 4.4, fixed upstream on October 5, and published as a CVE on October 15. Teams triaging this kernel flaw can track patch status across distros with daily.dev."}},{"@type":"Question","name":"How do I mitigate CVE-2026-98432 if my vendor hasn't released a patched kernel yet","acceptedAnswer":{"@type":"Answer","text":"Disable MPTCP by setting net.mptcp.enabled=0, or for Go 1.24+ programs set GODEBUG=multipathtcp=0, since the demonstrated exploit required an MPTCP listener. Also drop IPv4 packets carrying IP options with an iptables rule AWS provides, or put the host behind a load balancer that terminates TCP before reaching the kernel. None of these fully fix the bug; only a patched kernel and reboot do. Developers managing exposed Go servers can keep up with kernel CVE mitigations like this on daily.dev."}},{"@type":"Question","name":"Why would a Go server be vulnerable to the Linux MPTCP exploit even if I never configured MPTCP","acceptedAnswer":{"@type":"Answer","text":"Since Go 1.24, Go programs request multipath TCP by default for the sockets they listen on, according to the Go Security Team. If the underlying Linux kernel allows MPTCP, which some distributions like AlmaLinux and CloudLinux disable by default but many others allow, a Go server can become an MPTCP listener without anyone deliberately choosing it, exposing it to the demonstrated exploit. Go developers deciding how to patch production servers can follow kernel and runtime advisories on daily.dev."}}]} ```