7 hours ago
Introduction
We have received several questions about CVE-2026-98432, a flaw in how the Linux kernel sets up IPv4 TCP connections, present in Linux kernel versions 4.4 and later.
The vulnerability has a CVSS 3.1 score of 9.8, corresponding to a severity of High.
Our team is currently working on testing the fixes for CVE-2026-98432 for Ubuntu 22.04 LTS and newer. The fixes are currently in the -proposed pocket, so users who run their own kernel acceptance tests can choose to apply them as per our new SRU strategy for accelerating CVE fixes. A fix for older, still supported Ubuntu releases will follow.
To ensure stability across a wide ecosystem we perform extensive tests on more than 2,000 certified servers and devices. We will release the fixes in the updates pocket of the Ubuntu archive as soon as those tests are complete, and will update this blog with further details. Users can also check our CVE status page for up-to-date information.
Which Ubuntu releases are affected by CVE-2026-98432?
Release | Package Name | Remediation status
Trusty (14.04) | linux | Not affected
Xenial (16.04) | linux | Fix pending
Bionic (18.04) | linux | Fix pending
Focal (20.04) | linux | Fix pending
Jammy (22.04) | linux | Fix available in -proposed (5.15.0-203.213)
Noble (24.04) | linux | Fix available in -proposed (6.8.0-149.149)
Resolute (26.04) | linux | Fix available in -proposed (7.0.0-43.43)
Stonking (26.10) | linux | Fixed in 7.3.0-10.10
How to check if you are impacted by CVE-2026-98432
On your system, run the following command to get the version of the currently running kernel and compare the listed version to the corresponding table above.
The list of installed kernel packages can be obtained using the following command:
Impact of CVE-2026-98432
The vulnerability affects the IPv4 TCP connection handling in the Linux kernel and can lead to remote code execution. The yet-unreleased exploit generated by Anthropic is described as using Multipath TCP (MPTCP), although the vulnerability is not specific to MPTCP. At the time of writing, no other exploit is known to have been generated or published.
How to apply fixes for CVE-2026-98432
To enable the -proposed pocket follow these instructions. Alternatively, you can enable the -proposed pocket of the Ubuntu archive main component (which covers the Linux kernel images) using the following command:
Packages from the -proposed pocket are not selected for upgrade by default. You have to explicitly install the package by specifying the -proposed pocket corresponding to your release. For example, if your kernel has been installed via a meta-package, you can use the following command:
Once the security updates for the Linux kernel are installed, a reboot is required:
Ubuntu 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS receive these fixes as part of standard support.
If you are using Ubuntu 20.04 LTS or older, the Ubuntu Pro subscription offers coverage for up to 15 years. Ubuntu 20.04 LTS and 18.04 LTS are covered by Expanded Security Maintenance (ESM), while Ubuntu 16.04 LTS and 14.04 LTS require ESM with the Legacy add-on. Ubuntu Pro is free for up to 5 machines, or up to 50 machines for community members. Ubuntu Pro also provides access to Landscape which enables you to control the roll-out of security fixes across your estate. Learn more.
Mitigations for CVE-2026-98432
Mitigations that disable multipath TCP (MPTCP) are being recommended by various sources, but please note that the CVE fix is not specific to MPTCP. The recommendations are based exclusively on the fact that the yet-unreleased exploit generated by Anthropic is described as using MPTCP; no other exploit is known to have been generated or published. The Ubuntu Security Team believes that security updates are the only appropriate mitigation. For Ubuntu 22.04 LTS and newer, these are currently in qualification testing and available in the -proposed pocket, as mentioned above.
References
We have received several questions about CVE-2026-98432, a flaw in how the Linux kernel sets up IPv4 TCP connections, present in Linux kernel versions 4.4 and later.
The vulnerability has a CVSS 3.1 score of 9.8, corresponding to a severity of High.
Our team is currently working on testing the fixes for CVE-2026-98432 for Ubuntu 22.04 LTS and newer. The fixes are currently in the -proposed pocket, so users who run their own kernel acceptance tests can choose to apply them as per our new SRU strategy for accelerating CVE fixes. A fix for older, still supported Ubuntu releases will follow.
To ensure stability across a wide ecosystem we perform extensive tests on more than 2,000 certified servers and devices. We will release the fixes in the updates pocket of the Ubuntu archive as soon as those tests are complete, and will update this blog with further details. Users can also check our CVE status page for up-to-date information.
Which Ubuntu releases are affected by CVE-2026-98432?
Release | Package Name | Remediation status
Trusty (14.04) | linux | Not affected
Xenial (16.04) | linux | Fix pending
Bionic (18.04) | linux | Fix pending
Focal (20.04) | linux | Fix pending
Jammy (22.04) | linux | Fix available in -proposed (5.15.0-203.213)
Noble (24.04) | linux | Fix available in -proposed (6.8.0-149.149)
Resolute (26.04) | linux | Fix available in -proposed (7.0.0-43.43)
Stonking (26.10) | linux | Fixed in 7.3.0-10.10
How to check if you are impacted by CVE-2026-98432
On your system, run the following command to get the version of the currently running kernel and compare the listed version to the corresponding table above.
Code:
uname -rThe list of installed kernel packages can be obtained using the following command:
Code:
dpkg -l 'linux-image*' | grep ^iiImpact of CVE-2026-98432
The vulnerability affects the IPv4 TCP connection handling in the Linux kernel and can lead to remote code execution. The yet-unreleased exploit generated by Anthropic is described as using Multipath TCP (MPTCP), although the vulnerability is not specific to MPTCP. At the time of writing, no other exploit is known to have been generated or published.
How to apply fixes for CVE-2026-98432
To enable the -proposed pocket follow these instructions. Alternatively, you can enable the -proposed pocket of the Ubuntu archive main component (which covers the Linux kernel images) using the following command:
Code:
sudo add-apt-repository --component main --pocket proposed http://archive.ubuntu.com/ubuntuPackages from the -proposed pocket are not selected for upgrade by default. You have to explicitly install the package by specifying the -proposed pocket corresponding to your release. For example, if your kernel has been installed via a meta-package, you can use the following command:
Code:
sudo apt update
dpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install -t $(. /etc/os-release && echo $VERSION_CODENAME)-proposed --only-upgradeOnce the security updates for the Linux kernel are installed, a reboot is required:
Code:
sudo rebootUbuntu 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS receive these fixes as part of standard support.
If you are using Ubuntu 20.04 LTS or older, the Ubuntu Pro subscription offers coverage for up to 15 years. Ubuntu 20.04 LTS and 18.04 LTS are covered by Expanded Security Maintenance (ESM), while Ubuntu 16.04 LTS and 14.04 LTS require ESM with the Legacy add-on. Ubuntu Pro is free for up to 5 machines, or up to 50 machines for community members. Ubuntu Pro also provides access to Landscape which enables you to control the roll-out of security fixes across your estate. Learn more.
Mitigations for CVE-2026-98432
Mitigations that disable multipath TCP (MPTCP) are being recommended by various sources, but please note that the CVE fix is not specific to MPTCP. The recommendations are based exclusively on the fact that the yet-unreleased exploit generated by Anthropic is described as using MPTCP; no other exploit is known to have been generated or published. The Ubuntu Security Team believes that security updates are the only appropriate mitigation. For Ubuntu 22.04 LTS and newer, these are currently in qualification testing and available in the -proposed pocket, as mentioned above.
References