Kritisk Linux-kernesårbarhed CVE-2026-98432: Sådan kontrollerer og opdaterer du din VPS

In October 2026, a critical vulnerability, CVE-2026-98432, was found in the Linux kernel, rated 9.8 out of 10 on the CVSS scale. It affects how incoming IPv4 TCP connections are handled and, under certain conditions, allows an attacker to gain root access to a server remotely — with no password and no action required from the administrator.

Below is who is affected, how to check your server and how to protect it. All commands are run as root or with sudo.

The vulnerability in brief

• Hvad er det: a use-after-free bug in the code that sets up IPv4 TCP connections, caused by a race condition. The attacker sends specially crafted packets to any open TCP port.
• Affected kernels: every version since Linux 4.4, which means practically every current distribution.
• IPv6 is not affected by the main bug.
• How real the threat is: Anthropic researchers demonstrated a working exploit chain that gained root access on a server with Multipath TCP (MPTCP) enabled in about 53 minutes. The exploit code has not been published.
• Attacks in the wild: as of November 1, 2026, no exploitation has been reported. That is a reason to update calmly, not a reason to put it off.

Go services carry a separate risk. Since Go 1.24, server programs on Linux listen on ports via MPTCP by default whenever the kernel allows it. An administrator may not even know their server accepts such connections. Among popular programs, Xray works this way — its developers have already released an emergency version, v26.10.31, which disables MPTCP by default.

Each VPS runs its own kernel, so you need to update the kernel inside your server yourself. We update the virtualization nodes ourselves.

Is there a fix for your system

Status as of November 1, 2026. Fixes are landing almost daily — check the links at the end of this article for the current status.

Step 1. Check which kernel you are running

Find out the version of the running kernel:

uname -r

The version number alone tells you nothing: distributions backport fixes into their own kernels without changing the base version. It is more reliable to check the kernel package changelog — if it mentions the CVE number, the fix is already installed.

Debian and Ubuntu:

apt changelog linux-image-$(uname -r) 2>/dev/null | grep CVE-2026-98432

On Debian, the uname -v command also shows the full package version of the running kernel: compare it with the table above.

AlmaLinux, Rocky Linux, RHEL, Oracle Linux:

rpm -q --changelog kernel-core-$(uname -r) | grep CVE-2026-98432

If the command prints nothing, the running kernel is vulnerable.

Next, check which services accept connections via MPTCP. Servers like these were the target in the demonstrated attack:

ss -lnMp

Empty output means there are no MPTCP listeners.

Step 2. Install the fixed kernel

Take a backup or snapshot of your server before updating the kernel.

Debian 12 and 13

The fixed kernels are in the security repository. Make sure it is enabled:

grep -r security.debian.org /etc/apt/sources.list /etc/apt/sources.list.d/

If nothing is found, add the security.debian.org repository for your release. Then update the system:

apt update
apt full-upgrade
reboot

Ubuntu

Fixed kernels have not been released yet. Check for updates:

apt update
apt list --upgradable | grep linux-image

If your server is attached to Ubuntu Pro, you can check the fix plan:

pro fix CVE-2026-98432 --dry-run

Once the fix is released, install it and reboot:

apt update
apt full-upgrade
reboot

Until then, be sure to apply the temporary protection from Step 3.

AlmaLinux 8, 9, 10

Fixed kernels are currently available only in the testing repository. Install them if you are comfortable doing so on a production server, and be sure to take a snapshot before updating:

dnf install -y almalinux-release-testing
dnf update 'kernel*' --enablerepo=almalinux-testing
dnf config-manager --disable almalinux-testing
reboot

After rebooting, compare uname -r with the versions in the table above. If you would rather not install testing packages, apply the temporary protection and wait for the fix to reach the main repository.

Rocky Linux and other RHEL-based systems

There is no fix yet. You can watch for it with:

dnf --refresh updateinfo info --all --cves CVE-2026-98432

Once the fix is released:

dnf update kernel
reboot

After updating: a reboot is required

The new kernel only takes effect after a reboot. To check whether one is needed:

# Debian and Ubuntu
[ -f /var/run/reboot-required ] && echo "Reboot required"

# AlmaLinux, Rocky, RHEL
needs-restarting -r

After rebooting, repeat the check from Step 1.

Step 3. Temporary protection until a fixed kernel is available

These measures reduce the risk but do not replace a kernel update.

Block the trigger packets

The attack uses TCP packets with IP options in the IPv4 header. They practically never appear in normal traffic, and RFC 7126 already recommends dropping them. The nftables rule below drops all incoming IPv4 TCP packets with options and does not affect IPv6, UDP or ICMP. It works alongside ufw and firewalld.

Install nftables if it is not already installed:

# Debian and Ubuntu
apt install -y nftables

# AlmaLinux, Rocky, RHEL
dnf install -y nftables

Create the rule file:

cat > /etc/cve-2026-98432.nft <<'EOF'
table ip cve_2026_98432 {
    chain pre {
        type filter hook prerouting priority -300; policy accept;
        meta l4proto tcp ip hdrlength gt 5 counter drop
    }
}
EOF

To have the rule restored after every reboot, create a systemd service:

cat > /etc/systemd/system/cve-2026-98432.service <<'EOF'
[Unit]
Description=Mitigation for CVE-2026-98432
After=network-pre.target nftables.service firewalld.service ufw.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStartPre=-/usr/sbin/nft delete table ip cve_2026_98432
ExecStart=/usr/sbin/nft -f /etc/cve-2026-98432.nft
ExecStop=/usr/sbin/nft delete table ip cve_2026_98432

[Install]
WantedBy=multi-user.target
EOF

systemctl daemon-reload
systemctl enable --now cve-2026-98432.service

Check that the rule is loaded:

nft list table ip cve_2026_98432

If you restart the nftables service with a global flush ruleset rule, run systemctl restart cve-2026-98432 bagefter.

Vigtig: do not apply this rule on networks using CIPSO labels (SELinux or Smack NetLabel) — IP options are used normally there. If your server routes traffic for other machines, the rule will also drop their TCP packets with IP options.

Disable MPTCP if you do not need it

sysctl -w net.mptcp.enabled=0
echo "net.mptcp.enabled = 0" > /etc/sysctl.d/99-disable-mptcp.conf

This setting only prevents ny MPTCP sockets from being created. Services that are already running will keep listening via MPTCP, so restart every service listed by ss -lnMp and make sure its output is now empty.

On AlmaLinux, MPTCP is disabled by default unless you enabled it yourself.

Disable MPTCP in Go programs

For services built with Go 1.24 or later, you can disable MPTCP with an environment variable. For example, for a service called myservice:

systemctl edit myservice

Add the following to the file that opens:

[Service]
Environment=GODEBUG=multipathtcp=0

Then restart the service:

systemctl restart myservice

Update Xray

If your server runs Xray, update it to v26.10.31 or later. The previous version, v26.10.29, has been withdrawn by its developers. This update disables MPTCP but does not fix the kernel, so a kernel update is still required.

Check one more setting

A second, narrower exploitation path requires request migration to be enabled. It is off by default — make sure of it:

sysctl net.ipv4.tcp_migrate_req

The command should print 0.

Restrict access to your services

Close every firewall port that does not need to be reachable from the internet. Where possible, open administrative services — SSH, control panels, databases — only to trusted IP addresses.

Step 4. After installing the fixed kernel

1. Reboot the server and use the commands from Step 1 to confirm that the fixed kernel is running.
2. You can remove the temporary rule:
   

   systemctl disable --now cve-2026-98432.service
   rm /etc/systemd/system/cve-2026-98432.service /etc/cve-2026-98432.nft
   systemctl daemon-reload

   
   
3. If you need MPTCP, restore the setting: delete /etc/sysctl.d/99-disable-mptcp.conf og løbe sysctl -w net.mptcp.enabled=1.

Hvis noget går galt

If your server does not boot after the kernel update, connect via the VNC console in the control panel and select the previous kernel in the boot menu. If you are not sure you can do this yourself, or need help with the update, contact our support team.