Skip to main content

CVE-2026-98432: Linux TCP use-after-free bug

A serious bug in the Linux kernel’s TCP code could let an attacker take over a server. We’ve blocked the traffic it needs, and patches are on the way.

CVE-2026-98432: Linux TCP use-after-free bug

Jimmy Crutchfield

· Security & compliance

TL;DR as of 2 November:

  • Mitigation: in place. We’re blocking the traffic this bug relies on.
  • Prostack Cito servers: patches available. Rolling out over the next 24 hours.
  • cPanel and CloudLinux servers: patches in testing. We expect to roll them out soon.

We’ll update this post as each stage completes.

A serious bug has been found in the part of Linux that handles new network connections. It’s tracked as CVE-2026-98432, and the Linux kernel’s CVE team rates it 9.8 out of 10. In the worst case, an attacker with no account on a server could take full control of it.

The bug has been in Linux since 2016, so it affects almost every Linux server, including ours. We’ve blocked the traffic it needs, and patched kernels are on the way.

What the bug is

When someone visits your site, their device and your server first agree to open a connection. This is the TCP handshake: the visitor says hello, the server replies, and the visitor confirms. Only then does the connection reach your web server and your site. The handshake is handled by the Linux kernel, the core of the operating system, before any of your site’s code runs.

The visitor’s hello can carry optional extra information in its header, called IP options. Almost nothing uses them now, but Linux still supports them. When a hello arrives with IP options, the kernel keeps a copy so it can include them in its reply.

The bug is in how that copy is cleaned up. When the handshake finishes, the copy is handed to the new connection instead of being duplicated, so two parts of the kernel share the same piece of memory. If the connection closes quickly, one part frees that memory while the other is still reading it to build a reply.

This kind of bug is called a use-after-free. It’s the same kind of bug as one of the PHP vulnerabilities we wrote about in October. Once memory is freed, it can be reused for something else almost immediately, so the kernel reads whatever is there now. An attacker who gets the timing right can use this to read data from the kernel’s memory, and then to write their own instructions into it.

The timing is hard to get right. Two processor cores have to be working on the same connection at exactly the wrong moment, and most attempts fail. According to Anthropic, who reported the bug, a failed attempt only drops that one connection, so an attacker can keep trying.

Why it’s getting attention

The fix was added to the Linux kernel in early October. On 27 October, Anthropic published research saying an unreleased Claude model had written a working exploit for it. Starting with only network access, it gained root (full administrator) access to a server in under an hour.

The exploit hasn’t been published, and nobody has independently reproduced it. It targeted a server running a multipath TCP (MPTCP) listener. MPTCP is an extension to TCP that most servers don’t use. No attacks have been reported in the wild.

The bug itself is in ordinary TCP code, though, and the Go security team have warned that servers without MPTCP may be open to similar attacks. Code that triggers the bug is already on GitHub. We’re treating every server as affected.

What we’re doing

We’re blocking the traffic the bug needs. The attack only works if the visitor’s hello carries IP options. We’ve deployed a firewall rule that drops any TCP traffic carrying them before it reaches the vulnerable code. Browsers, search engines, payment gateways and APIs don’t send IP options, so your sites and visitors won’t be affected.

We don’t run MPTCP on any public-facing services, so the setup Anthropic’s exploit used isn’t available to attackers on our platform.

Neither of these is a fix. The bug stays in the kernel until the kernel is patched, so we’re patching as well:

  • Prostack Cito servers: patches available. We’re rolling them out to every Cito server over the next 24 hours.
  • cPanel and CloudLinux servers: patches in testing. We expect to roll them out soon.

What you need to do

If your sites are hosted with us, you don’t need to do anything. The bug is in the server’s operating system, not in your site, so updating WordPress, Magento, plugins or your own code won’t affect it. We’re patching the kernel for you.

If you also manage Linux servers elsewhere:

  1. Check your distribution’s advisory and install the fixed kernel as soon as it’s available. The fix only takes effect after a reboot or a live patch.
  2. Until then, consider dropping TCP traffic that carries IP options, as we have. AlmaLinux’s write-up includes an nftables rule and its caveats. Test it before deploying it.
  3. If nothing on the server needs MPTCP, turn it off with sysctl -w net.mptcp.enabled=0, then restart any services already listening with it.

If you build services in Go: since Go 1.24, Go programs on Linux open MPTCP listeners by default wherever the kernel allows it. The Go team’s advisory explains how to turn that off.

Our approach to security

Serious bugs are being found more often, and Anthropic’s research shows AI can now turn them into working attacks. We wrote about what that means for hosting in June.

When a bug like this is published, we block the attack, patch as quickly as we safely can, and keep you informed. We remain committed to keeping your sites and your customers’ data secure.

What happens next

We’ll update this post when the Cito rollout is complete, and again when the cPanel and CloudLinux patches are installed. If you have questions, contact our support team.

Prostack Cito is our fully managed platform. We patch it, monitor it and keep it secure, so you don’t have to. Take a look, or talk to us.

Sources