PTIR — Daily Briefing — November 6, 2026
by
Executive Summary
CVE-2026-98432 is a critical use-after-free in the Linux kernel’s IPv4 TCP handshake path. Unlike the local-privilege-escalation research covered in yesterday’s PTIR, this flaw can be reached by an unauthenticated remote attacker sending crafted IPv4 TCP traffic to a listening service. Fixed kernels are available for several distributions and cloud platforms. Update and reboot exposed Linux hosts now; do not treat disabling MPTCP as a complete mitigation.
Action Queue
Patch internet-facing Linux hosts for CVE-2026-98432
The bug affects Linux kernel versions from 4.4 onward and can cause a kernel crash, memory disclosure, memory corruption, or—under demonstrated MPTCP conditions—remote code execution. Red Hat rates it Critical at CVSS 9.8 and says ordinary IPv4 TCP handling remains exposed even when MPTCP is disabled. AWS reports no evidence of exploitation as of its latest bulletin, but patched Amazon Linux kernels are available. Debian’s tracker lists fixed security versions for Bookworm and Trixie.
Recommended action: inventory Linux systems accepting inbound IPv4 TCP connections; apply the distribution’s current kernel security update; reboot; and verify the running kernel afterward. On Debian Trixie, the tracker lists 6.12.115-2 as fixed; Bookworm’s security branch lists 6.1.190-1. For Amazon Linux, follow the vendor bulletin’s release and reboot instructions. If a supported fix is not yet available, Red Hat documents an interim nftables rule that drops inbound IPv4 TCP packets carrying IP options—but warns that it can disrupt workloads that depend on those options and is not a substitute for patching.
Urgency: Immediate
Importance: ★★★★★
Verified active: November 6, 2026
Deadline: No published cutoff; patch exposed hosts as soon as a supported kernel is available
Cost: Free security updates through supported distribution channels; no separate charge
Requirements: Administrative access, a maintenance window for reboot, and an inventory of hosts or VMs accepting inbound IPv4 TCP connections
Official sources: Linux kernel CVE announcement · Red Hat security bulletin and mitigation · Debian security tracker · AWS security bulletin
Linux & Self-Hosting
A public port is not the only inventory question: forwarding, load balancers, containers sharing the host kernel, and internal services reachable from less-trusted networks can all preserve exposure. Confirm the kernel that is actually running after reboot with uname -r; merely installing a package does not activate the fix.
Red Hat’s packet-filtering workaround targets the required IPv4 IP-options input. It is preferable to MPTCP-only advice, but it should be tested because certain CIPSO/NetLabel or other IP-options-dependent environments may be affected. Remove the temporary rule after installing and booting a fixed kernel.
PKb Candidates
- Kernel-response checklist: exposure inventory, vendor advisory, fixed package version, update, reboot, running-kernel verification, temporary mitigation, and mitigation removal.
- Threat-model distinction: remote unauthenticated kernel entry versus local low-privilege escalation; both may end in root, but their first controls differ.