Critical Linux Kernel Flaw CVE-2026-98432 Can Let an Attacker Crash or Take Over Linux Systems That Accept Network Connections

A critical flaw in the Linux kernel, the core of the Linux operating system, can let an attacker on the network crash a Linux machine or, under the right conditions, take full control of it without a password. It is tracked as CVE-2026-98432, and it sits in the code every Linux system uses to accept ordinary network connections. Patches are out from some Linux distributions and still in progress from others.

What was published

The Linux kernel security team published CVE-2026-98432 on 15 October 2026 and rated it 9.8 out of 10 (Critical) on the Common Vulnerability Scoring System (CVSS). It is a use-after-free flaw, meaning the kernel keeps using a piece of memory after it has already handed that memory back, in the code that handles new incoming Transmission Control Protocol (TCP) connections over IPv4. The trigger is a timing race during the connection handshake, and it needs no login and no action by a user. The kernel team lists every kernel from version 4.4 onward as affected until fixed. Fixed upstream kernel versions are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3.

As of 30 October 2026, Red Hat rates the flaw Critical, up from its earlier lower rating, and has published security bulletin RHSB-2026-016. Red Hat says a remote, unauthenticated attacker could use it to run code, that any system with IPv4 TCP networking is affected, and that systems accepting inbound connections are most exposed. Red Hat lists Red Hat Enterprise Linux (RHEL) 8, 9 and 10 and OpenShift as affected and says it is expediting fixes.

Researchers at Anthropic reported building a working remote root exploit, meaning full administrator control, against a Linux server running a Multipath TCP (MPTCP) listener. MPTCP is a feature that lets one connection use several network paths at once. According to BleepingComputer, remote code execution has not been publicly shown on servers without an MPTCP listener, but the underlying flaw is reachable through ordinary TCP traffic, and programs written in the Go programming language from version 1.24 turn MPTCP on by default on Linux.

Patch status on 30 October: Debian has fixed kernels for Debian 12 (6.1.190-1) and Debian 13 (6.12.113-1). Canonical lists Ubuntu 22.04, 24.04 and 26.04 as still vulnerable with fixes in progress. Red Hat says fixes are coming. There are no confirmed reports of attacks in the wild, and the flaw is not in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog as of this writing.

Where it shows up, plant floor to cloud

At the plant floor, Linux runs inside many industrial gateways, protocol converters, cellular routers, smart meters and newer controllers and human-machine interface (HMI) panels. Those devices get kernel fixes only when the equipment vendor ships a firmware update, which can take months.

In the control room and the buffer network between business and control systems, Linux servers run historians, supervisory control and data acquisition (SCADA) servers, data diodes and collectors, jump hosts and network security monitoring sensors. Many accept inbound connections all day.

At the cloud end, Linux runs the virtual machines and containers behind remote monitoring platforms, vendor portals and industrial internet of things (IIoT) services.

A crash alone matters in a plant. A historian or SCADA server that reboots without warning can blind operators. The bigger risk is an internet-facing or vendor-facing Linux box that becomes a foothold into the control network.

What the Red Tiger team recommends

1. Build a list of every Linux system in the operational technology (OT) environment, including the ones hidden inside vendor appliances, and note which ones accept connections from outside their own zone. Patch those first.
2. Apply your distribution's fixed kernel as soon as it is released, and reboot in a planned window, since a kernel fix does not take effect until the machine restarts. Ask your equipment vendors in writing when their firmware will include the fix.
3. Until a fix is installed, tighten who can reach these systems. Limit inbound connections to known addresses at the zone firewall. Red Hat has also published a temporary firewall rule that drops incoming IPv4 TCP packets carrying IP options, a rarely used part of the packet header; test it outside production first, because Red Hat warns it may affect some workloads and does not fully prevent the flaw.
4. Watch for unexpected reboots and kernel crash logs on Linux servers in the control network, and treat them as a possible sign of probing until proven otherwise.

Red Tiger Security has completed 500+ plant-safe OT assessments and trained 4,500+ engineers and operators, and our team can help you find the Linux systems in your plants and plan safe patch windows.

We are here to help, so check out our resources online at www.redtigersecurity.com and book a follow-up call with our team if you have any questions: https://calendly.com/jonathanpollet/30min

Sources: Red Hat security bulletin RHSB-2026-016 (https://access.redhat.com/security/vulnerabilities/RHSB-2026-016); Linux kernel CVE record CVE-2026-98432; Canonical and Debian security trackers; BleepingComputer, 30 October 2026.

‍