.svg?width=93&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home"){kind=logo}
.svg?width=7&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Top Navigation - Sign in - Icon")
High
Advisory: Linux Kernel TCP Vulnerability (CVE-2026-98432)
CVE(N)
CVE-2026-98432
PRODUKT(E)
N/A
Aktualisiert
2026 Nov 5
Artikelversion
2
Erstellt
2026 Nov 2
Veröffentlichungs-ID
sophos-sa-20261102-linux-kernel-tcp
Workaround
No
Overview
A use-after-free vulnerability in the Linux kernel's IPv4 TCP implementation, CVE-2026-98432, has been publicly disclosed. The Linux kernel CNA rates it CVSS 3.1 9.8 (Critical); Red Hat rates it 5.9, because exploitation depends on winning a race condition.
Under specific conditions, an unauthenticated remote attacker could execute code with kernel privileges. Researchers have demonstrated remote command execution in a lab setting against a server with a Multipath TCP (MPTCP) listener. Sophos is not aware of any public reports of this vulnerability being exploited in the wild at this time.
Applies to the following Sophos products
| Product | Remediation |
|---|---|
| Sophos SD-RED 20 and SD-RED 60 | Fixed in SD-RED firmware 3.0.012, released on November 5, 2026 as a Sophos Firewall pattern update. For installation steps, see SD-RED Firmware 3.0.012 pattern released: Fix for CVE-2026-98432. |
Sophos is continuing to investigate the impact of this vulnerability on its other products and services. We will update this advisory as our investigation progresses.
General guidance for non-Sophos Linux systems
The following guidance is for Linux systems that you manage yourself, such as servers and third-party appliances. It does not apply to the Sophos products listed above; for those, follow the remediation in the table.
Patching
The vulnerability has been fixed in the upstream Linux kernel, and Linux distributions are releasing updated kernel packages. Apply your distribution's kernel update when it is available, and reboot to load the patched kernel.
Identifying affected systems
- Identify Linux systems that accept TCP connections from untrusted networks, prioritising internet-facing systems.
- Check the running kernel version against your distribution's security tracker for CVE-2026-98432.
- Include Linux-based third-party appliances, and confirm patch status with those vendors.
Temporary mitigation
Disabling MPTCP reduces exposure to the publicly demonstrated attack path, but does not remove the underlying vulnerability. Treat it as a temporary measure only; it is not a substitute for applying a patched kernel.
Related information
Sophos Responsible Disclosure Policy
To learn about Sophos security vulnerability disclosure policies and publications, see the Responsible Disclosure Policy.