Fixes available for CVE-2026-98432

Introduction

This blog post has been updated on 9 November 2026 to reflect changes in the status of fixes for  CVE-2026-98432, a flaw in how the Linux kernel sets up IPv4 TCP connections, present in Linux kernel versions 4.4 and later.

The vulnerability has a CVSS 3.1 score of 9.8, corresponding to a severity of Critical. 

Fixes for CVE-2026-98432 for Ubuntu 22.04 LTS and newer are now available in the Ubuntu archive. Our team is currently working on testing the fixes for CVE-2026-98432 for Ubuntu 20.04 LTS and older, releases under ESM support.

An earlier version of this blog post described the instructions to enable for -proposed pocket for Ubuntu archive, as the standard support fixes for CVE-2026-98432 had not completed kernel certification, our extended qualification process. This is no longer necessary.

To ensure stability across a wide ecosystem we perform extensive tests on more than 2,000 certified servers and devices. We will release the fixes for Ubuntu 20.04 LTS, 18.04 LTS and 16.04 LTS in the ESM archive for Ubuntu Pro users as soon as those tests are complete, and will update this blog with further details. Users can also check our CVE status page for up-to-date information.

Which Ubuntu releases are affected by CVE-2026-98432?

How to check if you are impacted by CVE-2026-98432

On your system, run the following command to get the version of the currently running kernel and compare the listed version to the corresponding table above.

uname -r

The list of installed kernel packages can be obtained using the following command:

dpkg -l 'linux-image*' | grep ^ii

Impact of CVE-2026-98432

The vulnerability affects the IPv4 TCP connection handling in the Linux kernel and can lead to remote code execution. The yet-unreleased exploit generated by Anthropic is described as using Multipath TCP (MPTCP), although the vulnerability is not specific to MPTCP. At the time of writing, no other exploit is known to have been generated or published.

How to apply fixes for CVE-2026-98432

We recommend you upgrade all packages:

sudo apt update && sudo apt upgrade

If this is not possible and the Linux kernel is installed via a meta package, its update can be targeted directly: 

sudo apt update
dpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install --only-upgrade

Once the security updates for the Linux kernel are installed, a reboot is required:

sudo reboot

Ubuntu 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS receive these fixes as part of standard support. 

If you are using Ubuntu 20.04 LTS or older, the Ubuntu Pro subscription offers coverage for up to 15 years. Ubuntu 20.04 LTS and 18.04 LTS are covered by Expanded Security Maintenance (ESM), while Ubuntu 16.04 LTS and 14.04 LTS require ESM with the Legacy add-on. Ubuntu Pro is free for up to 5 machines, or up to 50 machines for community members. Ubuntu Pro also provides access to Landscape which enables you to control the roll-out of security fixes across your estate. Learn more.

Mitigations for CVE-2026-98432

Mitigations that disable multipath TCP (MPTCP) are being recommended by various sources, but please note that the CVE fix is not specific to MPTCP. The recommendations are based exclusively on the fact that the yet-unreleased exploit generated by Anthropic is described as using MPTCP; no other exploit is known to have been generated or published. The Ubuntu Security Team believes that security updates are the only appropriate mitigation. For Ubuntu 22.04 LTS and newer, these are currently in qualification testing and available in the -proposed pocket, as mentioned above. 

Managing the -proposed pocket

A previous version of this blog referenced  instructions to enable the -proposed pocket, as standard support release updates were undergoing kernel certification, our extended qualification process. This is no longer necessary for CVE-2026-98432, as the fixes are available in the -updates pocket of the Ubuntu archive. You can retain the configuration of the -proposed pocket and have early access to kernel security updates for subsequent cycles.

We recommended the following command to enable the -proposed pocket:

sudo add-apt-repository --component main --pocket proposed http://archive.ubuntu.com/ubuntu

To disable the -proposed pocket after it had previously been enabled, use the following command:

sudo add-apt-repository --remove --component main --pocket proposed http://archive.ubuntu.com/ubuntu

On Ubuntu 22.04 LTS, enabling the -proposed pocket can result in unintended upgrades being applied, because the -proposed pocket is used for Stable Release Updates (SRUs) for all userspace packages, as well. You can lower the priority of the -proposed pocket by using the following command:

cat << 'EOF' | sudo tee /etc/apt/preferences.d/proposed
Package: *
Pin: release a=jammy-proposed
Pin-Priority: 400
EOF 

On Ubuntu 24.04 LTS and newer, packages from the -proposed pocket are not selected for upgrade by default. You have to explicitly install the package by specifying the -proposed pocket corresponding to your release. For example, if your kernel has been installed via a meta-package, you can use the following command:

sudo apt update
dpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install -t $(. /etc/os-release && echo $VERSION_CODENAME)-proposed --only-upgrade

References

• https://ubuntu.com/security/CVE-2026-98432
• https://www.anthropic.com/research/discovering-vulnerabilities-with-claude