Security

CVE-2026-98432 Checker

A race in the Linux kernel's IPv4 TCP handshake lets a remote attacker use freed memory (CVSS 9.8). Anthropic turned it into a root exploit against servers with a multipath TCP listener, and Ubuntu and Red Hat have no fixed kernel yet. Paste the output of the commands below to see where this server stands.

Command output

Run on the server and paste the output (read-only)uname -rgrep -E '^(ID|VERSION_ID)=' /etc/os-releasesysctl net.mptcp.enabled net.ipv4.tcp_migrate_reqss -Mltn

(apt changelog linux-image-$(uname -r) 2>/dev/null; rpm -q --changelog kernel-$(uname -r) 2>/dev/null; rpm -q --changelog kernel-default 2>/dev/null) | grep -m1 -o CVE-2026-98432 || echo 'kernel changelog: fix not listed'

Paste the command output

Paste at least the uname -r line and the changelog line. The checker needs the kernel version and whether its changelog names the fix.

Fix: install a patched kernel

Debian already ships fixed kernels. As of October 29, Ubuntu and Red Hat do not: run the update anyway so the fix lands as soon as it ships, and reboot after a new kernel arrives. For other distributions, look up CVE-2026-98432 in your vendor's security tracker.

sudo apt update && sudo apt full-upgrade # Debian, Ubuntusudo dnf upgrade kernel # RHEL, Rocky, Alma, Oracle, Amazon Linux 2023sudo zypper patch # SUSEsudo reboot

Until then: shrink the attack surface

Turn off multipath TCP (new MPTCP sockets fail, most programs fall back to plain TCP) and request migration, now and after reboot. Restart any program that was listening with MPTCP.

sudo sysctl -w net.mptcp.enabled=0sudo sysctl -w net.ipv4.tcp_migrate_req=0printf 'net.mptcp.enabled = 0\nnet.ipv4.tcp_migrate_req = 0\n' | sudo tee /etc/sysctl.d/90-cve-2026-98432.conf

These settings close the published attack path, not the bug. No vendor has confirmed them as a full workaround.

Checked in your browser. What you paste is never uploaded.

发现问题或有想法？报告问题

CVE-2026-98432 Checker

您可能还喜欢