Top stories

Linux stable kernels released fixes in October 2026 for CVE-2026-98432, a critical use-after-free vulnerability in IPv4 TCP connection handling. The flaw affects kernels from Linux 4.4 onward that lack a distributor backport or an upstream fix, and can be reached remotely without authentication during the TCP handshake, before an application processes the connection. The Linux kernel CNA assigned a CVSS 3.1 score of 9.8; potential consequences include kernel-memory disclosure, memory corruption, crashes, and possible remote code execution. Fixed upstream versions include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. The patch replaces immediate memory freeing with RCU-delayed freeing so concurrent kernel readers cannot access released IPv4 option data. As of October 31, Ubuntu listed all releases as vulnerable and RHEL 8, 9, and 10 had no fix, while Debian, specified SUSE releases, Oracle UEK, and Amazon Linux had released fixes. Anthropic says its Claude model produced an unpublished proof-of-concept that executes commands as root on Linux servers with MPTCP listeners. Go programs running on Linux enable MPTCP by default for listen sockets from Go 1.24 where the kernel permits it. Administrators can reduce exposure by installing a vendor-fixed kernel and rebooting; temporary mitigations include filtering IPv4 TCP packets with IP options and disabling unused MPTCP listeners.