Is CVE-2026-98432 Patched in Ubuntu 24.04? Latest Update

CVE-2026-98432 is not yet patched in Ubuntu 24.04. Ubuntu currently lists the release as vulnerable, with a fix in progress for the Linux kernel package version 6.8.0-149.149.

The vulnerability affects the Linux kernel’s IPv4 TCP networking code and may allow a remote attacker to execute commands with root privileges. The risk is particularly serious for servers using Multipath TCP, also known as MPTCP.

What is CVE-2026-98432?

CVE-2026-98432 is a critical Linux kernel vulnerability involving a use-after-free flaw in IPv4 TCP processing.

This type of flaw occurs when the kernel continues using memory after it has already been released. An attacker may exploit the error with specially crafted network traffic and potentially gain control over how the operating system processes data.

The reported attack may not require a username, password, or interaction from a victim.

Is Ubuntu 24.04 affected?

Yes. Ubuntu 24.04 LTS is listed as vulnerable to CVE-2026-98432.

The expected fixed Ubuntu kernel package is 6.8.0-149.149. However, the fix is still listed as work in progress, so administrators should not assume that the update is already available.

Ubuntu 22.04, 26.04, and 26.10 are also listed as affected, with separate kernel updates being prepared for those releases.

Why MPTCP matters

Multipath TCP allows a connection to use several network paths. It can be useful for high-availability systems, mobile connections, cloud infrastructure, and network failover.

The reported exploit targets Linux servers with an MPTCP listener. If the attack succeeds, the attacker may be able to execute commands as root.

Root access gives an attacker extensive control over a server. They may install malware, create accounts, steal credentials, modify services, disable security tools, or use the compromised machine to attack other systems.

How to check your kernel

Run this command on Ubuntu 24.04:

uname -r

Check for available security updates:

sudo apt update sudo apt list --upgradable

After installing a kernel update, restart the system:

sudo reboot

Then confirm the running kernel:

uname -r

Installing a new kernel package does not protect the system until the server has booted into that kernel.

How to check MPTCP

Check whether MPTCP is enabled:

sysctl net.mptcp.enabled

If the result is net.mptcp.enabled = 1, MPTCP is enabled.

If your server does not need MPTCP, you can temporarily disable it:

sudo sysctl -w net.mptcp.enabled=0

To make the change persistent:

echo 'net.mptcp.enabled = 0' | sudo tee /etc/sysctl.d/99-disable-mptcp.conf sudo sysctl --system

Do not disable MPTCP on production systems without checking whether an application depends on it. The change may interrupt services that require multiple network paths.

What Ubuntu administrators should do

Until the official kernel update is released, administrators should:

Check the active kernel version.
Identify internet-facing Ubuntu 24.04 servers.
Check whether MPTCP is enabled.
Disable unnecessary MPTCP where safe.
Restrict untrusted inbound traffic.
Monitor authentication and system logs.
Review unfamiliar users, SSH keys, services, and processes.
Install the official Ubuntu update as soon as it becomes available.
Reboot and verify that the fixed kernel is active.

Firewall rules may reduce exposure, but they are not a permanent replacement for the kernel update.

How to check for compromise

Administrators of exposed systems should look for unexpected accounts, new SSH keys, unfamiliar services, unusual processes, unknown listening ports, changed firewall rules, and unexplained outbound connections.

Useful checks include:

who last -a ss -tulpn ps auxf

These checks cannot prove that a system is clean. If you suspect root-level compromise, isolate the server, preserve evidence, rotate credentials from a trusted device, and consider rebuilding the host.

Frequently asked questions

Is CVE-2026-98432 patched in Ubuntu 24.04?

No. Ubuntu 24.04 is currently listed as vulnerable, with the fix in progress for kernel package 6.8.0-149.149.

What is the expected Ubuntu 24.04 fix?

The planned fixed package is 6.8.0-149.149. Check Ubuntu’s update channels before treating the package as released.

Does every Ubuntu 24.04 server face the same risk?

No. Risk depends on the installed kernel, network exposure, MPTCP configuration, firewall rules, and whether the vulnerable code path can be reached.

Should I disable MPTCP?

Disable MPTCP if your system does not need it and the change will not disrupt production services. Treat this as temporary protection while waiting for the official kernel update.

Is updating the kernel enough?

After installing the update, reboot the server and run uname -r to confirm that it is using the new kernel.

Final answer

CVE-2026-98432 is not yet patched in Ubuntu 24.04 according to the current security status. The planned fix is kernel package 6.8.0-149.149, but the update remains in progress.

Check your kernel, review MPTCP exposure, disable unnecessary MPTCP, restrict network access, monitor for suspicious activity, and install the official Ubuntu update as soon as it is released.

Originally published at Flames Nova