Linux CVE-2026-98432: Red Hat lists RHEL kernel fixes
Standard RHEL 8, 9 and 10 kernel fixes are now listed. Other Red Hat components and Ubuntu kernel variants still need separate status checks; Amazon Linux fixes are also available.
Verified brief
The story in 60 seconds
Red Hat’s current CVE record lists November 1 fixes for the standard RHEL 8, 9 and 10 kernels, while some other components remain affected. Amazon Linux fixes are available. Ubuntu’s reviewed main linux package rows still show work in progress. Patch availability and whether a running system has been updated are separate facts.
This brief and the full story below are based on the disclosed sources. SearchTrends Daily’s interpretation appears later under “Our take.”
Full reporting
The complete story
Red Hat’s live CVE record, last modified November 2 at 16:21 UTC, lists standard kernel packages for RHEL 8, 9 and 10 as fixed, with errata released November 1. The same record still marks RHEL 9 kernel-rt and several OpenShift CoreOS entries affected. Those are package-specific statuses, not a declaration that every Red Hat deployment is patched.
Red Hat describes a race condition in processing TCP connection requests: one operation can release socket-option memory while another still uses it. That use-after-free can lead to memory corruption or a system crash. Its bulletin rates the issue Critical and identifies systems accepting inbound TCP connections as most directly exposed.
AWS’s November 1 update reports a remote-code-execution demonstration against MPTCP listeners. It says AWS is not aware of exploitation in the wild. A demonstration is not evidence that a particular organisation has been breached.
Multipath TCP is relevant to application configuration too. Official Go documentation says Go 1.24 changed its default to enable MPTCP on listeners. An administrator should therefore check the running application and kernel configuration rather than assume this feature was never selected.
Source perspectives
What other reporting adds
These are the reports, official records, and trend observations used to build the story. The note under each link explains exactly what it contributes.
Bulletin 2026-160-AWS, updated November 1: demonstrated MPTCP remote execution, no known in-the-wild exploitation to AWS, Amazon Linux fixes and service-specific responsibilities.
Read original source ↗Red Hat Product SecurityRHSB-2026-016 — Use-after-free in kernel IPv4October 30 primary bulletin: race condition, Critical impact, affected products, expedited fixes and limits of interim traffic filtering. Read current errata for package availability.
Read original source ↗Canonical / Ubuntu SecurityCVE-2026-98432 — Ubuntu package statusPrimary tracker, last updated October 30 when reviewed. Main linux rows remain vulnerable/work in progress for the specified releases; kernel flavours have separate entries.
Read original source ↗Go projectGo, backwards compatibility and GODEBUG — Go 1.24Primary documentation establishes the Go 1.24 default enabling MPTCP on listeners. This is configuration context, not evidence that a particular service is exposed.
Read original source ↗BleepingComputerCritical Linux kernel flaw allows remote root attacks on MPTCP serversLawrence Abrams’ October 30 independent report supplies the reporting chronology. Its earlier vendor severity and package descriptions are superseded here by directly reviewed primary advisories.
Read original source ↗Wikimedia Commons / Tony WebsterServer Rack (54126210834).jpg — archival equipment photographPhotographed May 18, 2019 by Tony Webster; CC BY 2.0. Generic infrastructure image only, not evidence about an affected system.
Read original source ↗Creative CommonsAttribution 2.0 Generic licenceLicence for the Tony Webster photograph. Original source and attribution supplied; Commons resize used without further editing, with possible layout cropping.
Read original source ↗Red Hat Product SecurityCVE-2026-98432 — affected packages and issued security errataLive CVE record last modified November 2 at 16:21:55 UTC, directly read in the browser. Standard RHEL 8, 9 and 10 kernels are Fixed with November 1 errata; some real-time and OpenShift CoreOS entries remain Affected.
Read original source ↗SearchTrends Daily opinion
Our take
Analysis
What the evidence and search signal suggest
Our assessment: the practical distinction is between the underlying TCP flaw, a demonstrated MPTCP exploitation scenario and evidence of real-world attacks. These should not be collapsed into a claim that every Linux server has been taken over. Equally, a demonstration involving MPTCP does not establish that ordinary TCP services are outside the affected code.
A vendor announcing a fixed package is a useful milestone. Whether that package is applicable, installed and active remains a separate operational check.
Analysis and commentary are SearchTrends Daily’s interpretation. They are intentionally separated from the sourced account above.
Meaning
Why this matters
A critical vulnerability and an installed fix are different facts. Service owners need to identify the distribution, exact kernel package and running kernel before they can establish whether their systems have received the relevant update.
Red Hat warns that filtering traffic can reduce exposure but may disrupt workloads and is not a substitute for patching. Treating a temporary network workaround as a complete repair could leave the underlying memory flaw unresolved.
Background
How we got here
The Ubuntu record dates publication of this CVE to October 15. Independent reporting by BleepingComputer on October 30 drew attention to the research demonstration; this briefing checks technical details against vendor records rather than carrying forward older patch or severity descriptions.
Amazon Linux: AWS lists fixed kernel packages for Amazon Linux 2 and Amazon Linux 2023. It says release-locked Amazon Linux 2023 systems need release 2023.12.20261102 or later to receive the update, and that the kernel update requires a reboot to take effect. This does not mean every AWS service or customer instance has already been updated.
Ubuntu: the reviewed tracker, marked last updated October 30, labels the main linux package rows for 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 as vulnerable with work in progress. A proposed version listed in that status is not the same as a released fix. The tracker has separate rows for other kernel variants.
Red Hat: the current CVE package table lists RHSA-2026:93414 for the RHEL 8 standard kernel, RHSA-2026:93412 for RHEL 9 and RHSA-2026:93413 for RHEL 10. Each row gives a November 1 release date. That newer package record now supplies release availability; the October 30 bulletin remains background on impact and mitigation. A fixed package still has to be applicable, installed and active on a particular system.
Outlook
What is likely to happen next
Check the vendor records for the exact operating system and service before scheduling maintenance. Confirm that the fixed kernel is active afterward.
We will update this same article for substantive vendor releases or authoritative exploitation findings. The vendor statuses above are dated observations, not a live guarantee for every package.
Image credit: Tony Webster / Wikimedia Commons, CC BY 2.0. “Server Rack,” photographed May 18, 2019. Commons’ 960-pixel resized file is used without further editing; the site may crop its display. This is an archival equipment-rack photograph, not an affected Linux host, an AWS facility or evidence of an attack. The original image and licence are linked in the disclosed sources.
A conditional editorial assessment based on the evidence available at the review date, not a guaranteed outcome.
Live record
Updates to this story
Red Hat package record now lists standard RHEL kernel fixes
Added Red Hat’s live CVE package table, last modified November 2 at 16:21:55 UTC. It lists the standard RHEL 8, 9 and 10 kernel packages as Fixed with November 1 errata, while RHEL 9 kernel-rt and several OpenShift CoreOS entries remain Affected. This replaces reliance on the October 30 bulletin for release availability. Ubuntu’s reviewed main linux rows still show work in progress. The original publication time, licensed image and distinction between available fixes and installed updates are preserved.
Commentary
What we think
Clear package information is more useful than a dramatic vulnerability nickname. This update adds a confirmed vendor release-status change while keeping the distinction between published fixes, installed updates and exploitation evidence visible.