Ubuntu has published fixes for CVE-2026-98432, a critical Linux kernel flaw in IPv4 TCP connection handling. It carries a CVSS 3.1 score of 9.8 and can lead to remote code execution.
The fixes for Ubuntu 22.04 LTS and newer are in the -proposed pocket, so they are not yet in the default updates channel.
Critical Linux Kernel Vulnerability
The bug is a use-after-free in tcp_v4_syn_recv_sock(). That function passes ownership of ireq->ireq_opt to the child socket without copying it.
If another CPU handles a retransmitted SYN, it can build a SYNACK while the child socket’s options are freed. Since the kernel stopped holding the listener lock for request sockets, nothing prevents this race.
A plain kfree() then leaves a dangling pointer in ip_options_build(). The upstream fix switches to kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor(). IPv6 is not affected by the first issue.
The bug comes from the same class of memory-lifetime errors seen in recent kernel flaws such as the SCTPhantom use-after-free, where a stale reference caused freed-object access.
Ubuntu says the exploit Anthropic generated is still unreleased. It reportedly uses Multipath TCP (MPTCP), but the vulnerability is not specific to MPTCP. No other exploit is known.
| Release | Status |
|---|---|
| 14.04 Trusty | Not affected |
| 16.04, 18.04, 20.04 | Fix pending |
| 22.04 Jammy | -proposed (5.15.0-203.213) |
| 24.04 Noble | -proposed (6.8.0-149.149) |
| 26.04 Resolute | -proposed (7.0.0-43.43) |
| 26.10 Stonking | Fixed in 7.3.0-10.10 |
Ubuntu’s public tracker still lists several of these builds as “work in progress”, so check it before you assume a release is patched.
Run uname -r to see the running kernel. Run dpkg -l ‘linux-image*’ | grep ^ii to list installed kernel packages. Compare both against the table above.
To apply the fixes, follow Ubuntu’s instructions for enabling the -proposed pocket. Packages from -proposed are not upgraded by default, so you must install them explicitly with apt install -t
Canonical says this route suits teams that run their own acceptance tests. It lets them move faster than the full certification cycle, which covers more than 2,000 certified servers and devices. This follows Canonical’s new kernel release strategy. Under it, SRU cycles shrink to two weeks, with kernels released weekly.
Ubuntu 20.04 LTS and older need Ubuntu Pro. 20.04 and 18.04 fall under Expanded Security Maintenance (ESM), while 16.04 and 14.04 require ESM with the Legacy add-on.
Some sources recommend disabling MPTCP. Ubuntu’s security team says security updates are the only appropriate mitigation, because the flaw is not MPTCP-specific.
The CVE page does list an interim nftables rule that drops incoming IPv4 TCP packets carrying IP options. It reduces risk but does not fully prevent exploitation. It also breaks any connection that depends on IPv4 options.
Kernel disclosures are arriving faster. The Linux kernel team recently published roughly 440 CVE advisories in 24 hours, which strains patch pipelines.
Admins should prioritize internet-facing Ubuntu servers and test the proposed kernels now. Also review exposure from other recent kernel bugs, such as the Pedit COW privilege-escalation flaw, which affected Ubuntu releases from 18.04 through 26.04.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
