.svg?width=93&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home"){kind=logo}
.svg?width=7&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Top Navigation - Sign in - Icon")
High
Advisory: Linux Kernel TCP Vulnerability (CVE-2026-98432)
CVE(N)
CVE-2026-98432
产品(N)
N/A
更新日
2026 Nov 6
文章版本
3
公開日
2026 Nov 2
公開 ID
sophos-sa-20261102-linux-kernel-tcp
回避策
No
Overview
A use-after-free vulnerability in the Linux kernel's IPv4 TCP implementation, CVE-2026-98432, has been publicly disclosed. The Linux kernel CNA rates it CVSS 3.1 9.8 (Critical); Red Hat rates it 5.9, because exploitation depends on winning a race condition.
Under specific conditions, an unauthenticated remote attacker could execute code with kernel privileges. Researchers have demonstrated remote command execution in a lab setting against a server with a Multipath TCP (MPTCP) listener. Sophos is not aware of any public reports of this vulnerability being exploited in the wild at this time.
Applies to the following Sophos products
| Product | Remediation |
|---|---|
| Sophos Firewall | Hotfix HF110626.1 released on November 6, 2026 for v23.0 GA, v23.0 EAP1 and v22.0 MR3. A firewall restart is required to install the hotfix. With the "Allow automatic installation of hotfixes" feature enabled, the hotfix downloads automatically. Enabled is the default setting. If your firewall is running a different version, we recommend upgrading to a supported version (v22.0 MR3 or v23.0) to receive the hotfix. We'll update this advisory when hotfixes become available for other versions. For installation and verification steps, see Sophos Firewall: Hotfix for CVE-2026-98432 kernel vulnerability. |
| Sophos SD-RED 20 and SD-RED 60 | Fixed in SD-RED firmware 3.0.012, released on November 5, 2026 as a Sophos Firewall pattern update. For installation steps, see SD-RED Firmware 3.0.012 pattern released: Fix for CVE-2026-98432. |
Sophos is continuing to investigate the impact of this vulnerability on its other products and services. We will update this advisory as our investigation progresses.
General guidance for non-Sophos Linux systems
The following guidance is for Linux systems that you manage yourself, such as servers and third-party appliances. It does not apply to the Sophos products listed above; for those, follow the remediation in the table.
Patching
The vulnerability has been fixed in the upstream Linux kernel, and Linux distributions are releasing updated kernel packages. Apply your distribution's kernel update when it is available, and reboot to load the patched kernel.
Identifying affected systems
- Identify Linux systems that accept TCP connections from untrusted networks, prioritizing internet-facing systems.
- Check the running kernel version against your distribution's security tracker for CVE-2026-98432.
- Include Linux-based third-party appliances, and confirm patch status with those vendors.
Temporary mitigation
Disabling MPTCP reduces exposure to the publicly demonstrated attack path, but does not remove the underlying vulnerability. Treat it as a temporary measure only; it is not a substitute for applying a patched kernel.
Related information
Sophos Responsible Disclosure Policy
To learn about Sophos security vulnerability disclosure policies and publications, see the Responsible Disclosure Policy.