Patch Affected Linux Kernels for TCP Vulnerability

This message is intended for U-M IT staff who are responsible for Linux systems, particularly servers with exposed TCP services. This will also be of interest to individuals who run Linux systems for personal use.

Summary

CVE-2026-98432 is a use-after-free vulnerability in the Linux kernel’s IPv4 TCP connection-handling code. It can cause information disclosure, memory corruption, or a system crash. Linux administrators should install fixed vendor kernels where available and monitor vendor updates for Linux releases still waiting for a fix. Note that RHEL 7 is not affected.

Problem

Threat actors who can reach a system with exposed TCP services could trigger a race condition during the TCP handshake, causing the kernel to access freed memory containing IPv4 connection options. The reported root-level exploit targets multi-path TCP (MPTCP) listeners, but the underlying vulnerability is not specific to MPTCP. Systems without MPTCP listeners should not be assumed safe.

Threats

The kernel CVE team rates the flaw 9.8. Vendors assign lower scores, reflecting differing assessments of attack complexity and impact; Red Hat’s published ratings are inconsistent. Anthropic reports a successful research exploit, not observed attacks against production systems. No in-the-wild exploitation was reported in the material through October 29, 2026. Anthropic reports research demonstrating unauthenticated remote command execution as root on servers with a multipath TCP listener; the tested configuration and exploit code have not been disclosed.

Affected Systems

The flaw was introduced in Linux 4.4. Distribution kernel backports and package versions determine whether a particular system remains vulnerable. The following are examples of commonly-used distributions at U-M. If your Linux distribution or version is not listed, please check your distribution's web site for current status information.

For the Distributions most commonly used at U-M see the CVE article for each distribution:

Detection

Review installed kernel packages against current vendor advisories. An upstream version number alone does not establish patch status because distributions may backport fixes. No validated indicators of compromise or exploit-detection rules are available at this time. 

Action Items

Install applicable fixed vendor kernels as soon as possible after appropriate testing. 

If a fix is unavailable for a version of Linux you are using, monitor the vendor’s security advisory. Do not treat disabling MPTCP as a substitute for patching.

Technical Details

The kernel transfers IPv4 options from a pending connection request to a new socket without copying them. If the socket is destroyed while another CPU is still reading those options, a use-after-free can occur. The fix delays freeing the options until other CPUs finish reading them. IPv6 connections are not affected by this specific race.

How We Protect U-M

ITS provides CrowdStrike Falcon to units, which should be installed on all U-M owned systems (Windows, macOS, and Linux operating systems, whether workstations or servers). Falcon administrators in ITS and in U-M units use the Falcon console to investigate and remediate issues.

Questions, Concerns, Reports

Please contact ITS Information Assurance through the ITS Service Center.

Sincerely,

ITS Information Assurance

References