Linux kernel TCP vulnerability (CVE-2026-98432)

ServerPilot has applied mitigations to all servers for a critical vulnerability in the Linux kernel’s IPv4 TCP handling (CVE-2026-98432). This vulnerability can be triggered remotely by an attacker who does not need to log in to the server, and it affects Linux kernels 4.4 and later on all distributions, including Ubuntu.

We finished applying the mitigations to all servers on November 4, 2026.

These mitigations protect your server from remote attacks that exploit this vulnerability over the network. The permanent fix is to install the updated Linux kernel when it is available and then reboot the server.

About the vulnerability

CVE-2026-98432 is a use-after-free bug in how the Linux kernel handles IPv4 TCP packets. It is rated critical (CVSS 9.8).

The vulnerability was first published on October 15, 2026, as one of the many Linux kernel bug fixes that are published as CVEs. At that time, it had no severity rating and the only public information about the bug was the description of the fix.

On October 24, 2026, the vulnerability was rated critical after it was found that it can be triggered remotely.

On October 27, 2026, the researchers who found the bug published research showing that, on servers using MPTCP, it can be exploited remotely to run commands as root without logging in to the server. Others have since posted code publicly that triggers the bug to crash a server, but as of November 4, 2026, no working exploit for remote command execution has been published.

An attacker can trigger the bug by sending TCP packets that carry IPv4 options to a server. IPv4 options are an optional part of the IPv4 packet header, and normal internet traffic, including web traffic, does not use them.

As of November 4, 2026, Ubuntu is still testing updated kernels and has not released them yet. See What the Linux kernel and Ubuntu have done for details, including older Ubuntu releases.

Affected Ubuntu releases

The vulnerability affects Linux kernel 4.4 and later.

What we have done

ServerPilot has made two changes to all servers to protect them from remote attacks that exploit this vulnerability:

• Blocked TCP packets that carry IPv4 options. We added a firewall rule that drops IPv4 TCP packets that carry IPv4 options, both packets the server receives and packets the server sends. Because normal traffic does not use IPv4 options, this should not affect your apps or other services.
• Disabled MPTCP. We set net.mptcp.enabled to 0, which stops programs from opening new Multipath TCP (MPTCP) sockets. The exploit described by the researchers who found the bug relies on MPTCP. Nginx, Apache, PHP, and SSH do not use MPTCP.

Together, these changes block the known ways to exploit this vulnerability over the network. The underlying bug remains in the kernel until the server installs an updated kernel and is rebooted, so you should still install the update when it is available.

The mitigations do not protect against:

• Someone who can already run code on the server, such as through a compromised app or a user account on the server.
• Network traffic that stays inside containers or other isolated network environments on the server.
• Ways of exploiting the vulnerability that are discovered in the future.

What the Linux kernel and Ubuntu have done

The Linux kernel developers have fixed the vulnerability in Linux 7.3 and in the stable kernels 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, and 7.2.10.

As of November 4, 2026, Ubuntu is testing updated kernels for Ubuntu 22.04, Ubuntu 24.04, and Ubuntu 26.04 but has not yet released them. Ubuntu has not said when the updated kernels will be released.

Ubuntu has not yet released updated kernels for Ubuntu 16.04, Ubuntu 18.04, and Ubuntu 20.04, or for Ubuntu 14.04’s 4.4 kernel. When it does, they will only be available through the paid version of Ubuntu called Ubuntu Pro. Updated kernels for Ubuntu 14.04 and Ubuntu 16.04 will require Ubuntu Pro with the Legacy add-on.

Servers that have automatic updates enabled (the ServerPilot default) and that are running Ubuntu releases that still receive updates will automatically install the updated kernel when it is available. The updated kernel is not used until you reboot the server.

What you should do

Confirm ServerPilot’s mitigations were applied

To confirm both of ServerPilot’s mitigations were applied, SSH into your server as root and run the following command:

if iptables -t raw -C PREROUTING -p tcp -m u32 --u32 "0>>24&0xF=6:15" -j DROP 2>/dev/null && iptables -t raw -C OUTPUT -p tcp -m u32 --u32 "0>>24&0xF=6:15" -j DROP 2>/dev/null && [ "$(cat /proc/sys/net/mptcp/enabled 2>/dev/null || echo 0)" = 0 ]; then echo "Mitigation is applied"; else echo "Mitigation is NOT applied"; fi

If the output is Mitigation is applied, both mitigations were applied.

If the output is Mitigation is NOT applied, please check your server for problems such as a full disk and contact support to have the mitigations re-applied.

Confirm the server still receives updates from Ubuntu

Servers running Ubuntu 20.04 or earlier do not receive updates from Ubuntu unless the server is running the paid version of Ubuntu called Ubuntu Pro. Servers running Ubuntu 14.04 or Ubuntu 16.04 also need Ubuntu Pro’s Legacy add-on.

To determine which Ubuntu release a server is running, either view the server’s OS Info in the ServerPilot dashboard or run the following command on the server:

cat /etc/lsb-release

Reboot after the updated kernel is installed

Ubuntu has not yet released the updated kernel, so there is nothing to install yet and you do not need to reboot your server now. ServerPilot’s mitigations stay in place when the server is rebooted.

When Ubuntu releases the updated kernel, servers with automatic updates enabled will install it, but the server keeps running the old kernel until it is rebooted. We will update this post with how to check whether a server needs to be rebooted and how to confirm it is running the updated kernel.

Contact support

If you have questions about your server, please contact support.