Informational

Advisory: Linux Kernel TCP Vulnerability (CVE-2026-98432)

CVE(S)

CVE-2026-98432

PRODUCT(S)

N/A

Updated

2026 Nov 2

Article Version

First Published

2026 Nov 2

Publication ID

sophos-sa-20261102-linux-kernel-tcp

Workaround

Yes

Overview

A use-after-free vulnerability in the Linux kernel's IPv4 TCP implementation, CVE-2026-98432, has been publicly disclosed. The Linux kernel CNA rates it CVSS 3.1 9.8 (Critical); Red Hat rates it 5.9, because exploitation depends on winning a race condition.

Under specific conditions, an unauthenticated remote attacker could execute code with kernel privileges. Researchers have demonstrated remote command execution in a lab setting against a server with a Multipath TCP (MPTCP) listener. Sophos is not aware of any public reports of this vulnerability being exploited in the wild at this time.

Applies to the following product(s) and version(s)

Sophos is investigating the impact of this vulnerability on its products and services. We will update this advisory as our investigation progresses.

Remediation

The vulnerability has been fixed in the upstream Linux kernel, and Linux distributions are releasing updated kernel packages. Apply your distribution's kernel update when it is available, and reboot to load the patched kernel.

Identifying affected systems

Identify Linux systems that accept TCP connections from untrusted networks, prioritising internet-facing systems.
Check the running kernel version against your distribution's security tracker for CVE-2026-98432.
Include Linux-based third-party appliances, and confirm patch status with those vendors.

Workaround

Disabling MPTCP reduces exposure to the publicly demonstrated attack path, but does not remove the underlying vulnerability. Treat it as a temporary measure only; it is not a substitute for applying a patched kernel.

Related information

Sophos Responsible Disclosure Policy

To learn about Sophos security vulnerability disclosure policies and publications, see the Responsible Disclosure Policy.