Linux kernel CVE-2026-98432 (CVSS 9.8): mitigation

Published on November 6, 2026 · The mitza.es team

Much of the infrastructure companies rely on runs on Linux without anyone remembering it: the online store's web server, the virtual machine that hosts the management software, a cloud container or a network device. On October 30, 2026 Red Hat published a security bulletin about a flaw in the Linux kernel (the core of the operating system) that it identifies as CVE-2026-98432 and scores 9.8 out of 10. The bulletin was updated on November 4. This article summarizes what Red Hat has confirmed as of November 6, 2026, without going beyond what its advisories say.

What Red Hat says

Identifier and severity: CVE-2026-98432, bulletin RHSB-2026-016. CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which means: it is attacked over the network, in a straightforward way, without privileges and without any user intervention. Red Hat and the CVE record agree on the figure. For Red Hat products the severity is critical.
What fails: a race condition in the handling of TCP networking. When the system simultaneously processes retransmitted connection requests or socket migrations, the socket options can be released from memory while another part of the system is still using them. In plain language: the kernel “throws away” a piece of data it still needs, and an attacker could take advantage of that gap.
What the attacker needs: to send packets with IP options to a system that accepts TCP connections over IPv4, and to hit the right moment of two concurrent operations. It is a remote attack with no authentication, but it requires precise timing.
What the consequences are: Red Hat mentions denial of service, memory corruption and remote code execution. Reliable code execution requires precise control of memory, so the latter is the hardest to achieve; the bulletin's notice does flag it as possible.
Dates: published on October 30, 2026 and updated on November 4.

Which systems are affected

Red Hat lists as directly affected Red Hat Enterprise Linux 8, 9 and 10 and Red Hat OpenShift Container Platform 4 (the nodes running RHEL CoreOS). Products built on the RHEL kernel, such as Red Hat OpenStack Platform and Red Hat Virtualization, may also be affected. Systems that accept incoming TCP connections are the most exposed. The MPTCP protocol does not need to be active for the risk to exist.

An important caveat: Red Hat only documents its own products and does not give version numbers of the original (upstream) kernel or specific fixed packages (it “is accelerating the release of the fixes”; the status is listed as “in progress”). We have not been able to confirm the status in other distributions such as Debian, Ubuntu, AlmaLinux or Rocky; check your distribution's security advisory before ruling the problem out.

Is it being exploited yet?

Neither the bulletin nor Red Hat's entry says the flaw is being exploited, and it is not listed as exploited in the information we have reviewed. That can change at any moment, and a flaw that is attacked over the network and without credentials is an obvious candidate. It should be treated as a priority patch, not as a task for the next maintenance window.

What to do today: checklist

Take stock. Write down which servers, virtual machines, containers and network devices in your company run Linux, with which distribution and who manages them. If a provider or a hosting company manages them, ask them in writing to confirm whether you are affected and when they will apply the patch.
Check version and distribution. On a Linux server, cat /etc/os-release gives you the distribution and uname -r the kernel version.
Apply the kernel update as soon as one exists for your distribution. A new kernel requires restarting the system (unless you use live patching), so plan for it. Red Hat says it is the “only complete solution”.
While there is no patch, apply the temporary mitigation. Red Hat proposes dropping incoming TCP packets that carry IP options, with an nftables rule (see below).
Limit what is exposed. A server that only needs to serve you should not accept connections from the whole internet. Review the firewall: if you want to go over how it is organized, see our guide to what a firewall is and what a small business needs.
Have a recent, tested backup before touching anything: the 3-2-1 rule is still your insurance.

Red Hat's temporary mitigation

Red Hat proposes an nftables rule that drops IPv4 TCP packets with IP options. It is saved in a file (for example, cve-2026-98432.nft) with this content:

table inet cve_2026_98432 {
    chain input {
        type filter hook input priority -310; policy accept;
        ip protocol tcp ip hdrlength > 5 counter drop
    }
}

It is checked with sudo nft --check --file cve-2026-98432.nft and applied with sudo nft --file cve-2026-98432.nft. Two warnings from Red Hat: the rule does not persist after a reboot, and it is not a substitute for the patch. Once the kernel is updated, it is removed with sudo nft delete table inet cve_2026_98432. Test the rule first in a controlled environment and, if you are not sure what you are doing on a production server, let your administrator apply it.

What Red Hat advises against: disabling MPTCP (net.mptcp.enabled=0) is not a complete mitigation and, in fact, RHEL ships with it disabled by default and is still vulnerable. Nor can ss -Mlnp be used as a test of exposure. On OpenShift, pod-to-pod traffic has no mitigation yet; Red Hat points to a specific support article.

What if I don't manage servers?

If your website is on shared or managed hosting, this patch is the provider's responsibility: the sensible thing is to ask whether they have already applied it. If you have a virtual server (VPS) or a server of your own, it is down to you or whoever administers it. Either way, it is a good occasion to set a maximum patching deadline for critical flaws and to check that your provider keeps you informed when something like this happens. If you are thinking of hosting your infrastructure off your premises, this guide to cloud computing for small businesses helps you decide which part each side manages.

Quick questions

Does it affect me if I use Windows?

Not this flaw, which is in the Linux kernel. If you use Windows, the relevant calendar is that of the monthly updates; for example, in October there was a Patch Tuesday with more than 1,400 vulnerabilities.

What does “9.8” mean and is it the maximum?

The CVSS scale goes up to 10. A 9.8 indicates a very high risk: network access, no credentials and total impact on confidentiality, integrity and availability. The real severity also depends on whether the system is exposed and how hard it is to exploit, which here requires precise timing.

Does it have anything to do with the NIS2 regulation?

Vulnerability and supplier management are part of the measures expected of the companies the directive covers. You can find the context in our guide to the NIS2 regulation for small businesses.

How we can help at Mitza

We review which servers and devices you have exposed, check versions, apply patches and mitigations and leave the process documented. Find out how we approach IT maintenance for small businesses or tell us about your case on the contact page.

Critical Linux kernel flaw (CVE-2026-98432): which servers are affected and how to mitigate it until the patch arrives