News › security
By The Linux Camp News, November 3, 2026
Atlas reported Ubuntu kernel updates still in progress. The IPv4 TCP flaw involves prematurely freed option data, but the reported remote-root demonstration has a narrower MPTCP scope.
Ubuntu's kernel tracker still marked CVE-2026-98432 vulnerable at noon CST on November 2, 2026, according to Atlas. Its report listed work-in-progress packages for Ubuntu 26.10, 26.04, 24.04 and 22.04, similar entries for many cloud and hardware-enablement kernels, and no Ubuntu Security Notice. This is an outstanding distribution-update story, not a new vulnerability announcement. The report was retrieved November 3; its November 2 checkpoint does not establish Ubuntu's November 3 package availability. 1
The official CVE record explains the underlying race: TCP request processing can proceed without holding the listening socket's lock. A child socket, representing the connection being accepted, can therefore be freed while another processor is still building a SYNACK handshake response. Its IPv4 option memory is released immediately, leaving the response-building code accessing freed storage. That is a use-after-free: the reader retains access to memory whose lifetime has already ended. 2
The fix changes destruction of both socket and request-socket options to use kfree_rcu(). RCU, or read-copy-update, lets existing readers finish before memory is reclaimed; delaying the free through its grace period protects readers already using that mechanism. The record also distinguishes IPv6: it copies options in the first path, avoiding that particular defect, but has a separate request-migration issue involving CALIPSO options. This is not a blanket IPv6 safety assurance. 2
The official CVE record retrieved November 3 assigns CVSS 3.1 severity 9.8, Critical. That score is an assessment, not evidence of attacks. Atlas attributes kernel-memory disclosure, corruption and crashes to the Linux CNA's scoring notes, while quoting Red Hat's assessment that an unauthenticated remote attacker could trigger code execution through the race. Those are assessed consequences, distinct from a demonstrated exploit. 2 1
For the research demonstration, Atlas reports Anthropic's claim that Claude produced a remote-root exploit against servers with a multipath TCP listener. Multipath TCP is the configuration qualifier attached to that claim; it should not be dropped when describing the result. Atlas says the exploit was unpublished. The supplied evidence therefore does not demonstrate remote-root execution against every ordinary TCP listener. 1
Container operators need to investigate the host, not just their application images. Atlas traces the affected code back to Linux 4.4 and describes kernels lacking the fix as affected. Containers share the host kernel, so rebuilding or replacing an image does not repair this defect. That makes host-kernel patch tracking relevant even where application deployment is entirely container-based. 1
Check the vendor tracker for the exact Ubuntu kernel package and flavour. Do not decide patch status by comparing its base version with an upstream fixed release: distributions backport fixes while retaining their own version numbering. Likewise, the reported work-in-progress package numbers are not proof that fixed packages were available. The useful check is whether the vendor identifies the particular package as fixed and released. 1
Keep installed and running kernel versions separate in that inventory. Atlas says this kernel fix takes effect after a reboot. Consequently, finding a fixed package installed on disk is not sufficient evidence that the running kernel contains the repair; activation needs its own verification. 1
Observed exploitation remains unestablished by this packet. The official CISA lookup retrieved November 3 reports no entry for this CVE in its October 30 catalog snapshot, which does not prove attacks have not occurred. Atlas also says it had not tested public proofs of concept. Ubuntu's later package status likewise requires a fresh vendor check rather than extending the November 2 report forward. 3 1