Zero Radar
← feed
CriticalVulnerabilityCVE-2026-98432updated 1 Nov 2026, 07:48 UTC

Linux kernel TCP flaw lets remote attackers run commands as root

A bug in how Linux handles network connections can let an outsider with no password take full control of a server. Attackers can reach it over the internet if the server accepts connections.

Attacks reported (The Hacker News, BleepingComputer)Fix availableOfficial, 6 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?ReportedBy The Hacker News, BleepingComputer, not officially confirmed yet
Fix available?YesKernel 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, or 7.2.10 and later, depending on your branch. · since 29 Oct 2026
How sure is this?Official, 6 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo credentials needed, reaches server over network
  2. 2Crafted SYN packetsRetransmitted SYNs trigger a race on request sockets
  3. 3Freed memory reusedKernel reads inet_opt after it was freed
  4. 4Code runs in kernelUse-after-free in ip_options_build()
  5. ResultAttacker runs commands as root

What happened

A use-after-free in the Linux kernel's IPv4 TCP code (ireq_opt and inet_opt freed with plain kfree() while still in use) lets a remote unauthenticated attacker trigger code execution as root.

Why it is dangerous: An attacker with network access to a vulnerable server can gain root without credentials. Servers running MPTCP listeners are specifically named as targets, and Ubuntu and RHEL are named as affected distributions.

Are you affected?

You are affected if you run a Linux kernel in these ranges: 4.4.0 to before 5.10.272, 5.11.0 to before 5.15.223, 5.16.0 to before 6.1.190, 6.2.0 to before 6.6.159, 6.7.0 to before 6.12.113, 6.13.0 to before 6.18.56, or 6.19.0 to before 7.2.10.

Package / productAffected versionsFixed in
Kernel · linux>= 4.4.0, < 5.10.2725.10.272
Kernel · linux>= 5.11.0, < 5.15.2235.15.223
Kernel · linux>= 5.16.0, < 6.1.1906.1.190
Kernel · linux>= 6.2.0, < 6.6.1596.6.159
Kernel · linux>= 6.7.0, < 6.12.1136.12.113
Kernel · linux>= 6.13.0, < 6.18.566.18.56
Kernel · linux>= 6.19.0, < 7.2.107.2.10

What to do

  1. Update the Linux kernel to the fixed version for your branch, listed above, and reboot.
  2. If you cannot patch yet, disable MPTCP with sysctl -w net.mptcp.enabled=0. Programs that need MPTCP may then fail.
  3. Also, until patched, drop inbound TCP packets that carry IPv4 options using an nftables rule, as AlmaLinux published.

Timeline

  1. 15 Oct 2026, 13:17 UTC
    Publicly disclosed
  2. 29 Oct 2026, 15:57 UTC
    Reported by The Hacker News · The Hacker News
  3. 29 Oct 2026, 16:57 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 17:03 UTC
    OSV reported on it · OSV
  5. 29 Oct 2026, 17:03 UTC
    Fixed version published: Kernel 5.10.272, Kernel 5.15.223, Kernel 6.1.190 · OSV
  6. 29 Oct 2026, 17:03 UTC
    Fix: Kernel 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 or 7.2.10 (and later).
  7. 29 Oct 2026, 21:05 UTC
    Hacker News reported on it · Hacker News
  8. 30 Oct 2026, 00:30 UTC
    oss-security reported on it · oss-security
  9. 30 Oct 2026, 02:18 UTC
    NVD reported on it · NVD
  10. 30 Oct 2026, 02:33 UTC
    Reported by Hacker News · Hacker News
  11. 30 Oct 2026, 12:16 UTC
    Reported by oss-security · oss-security
  12. 30 Oct 2026, 21:09 UTC
    Reported by BleepingComputer · BleepingComputer
  13. 31 Oct 2026, 09:23 UTC
    Reported by Hacker News · Hacker News
  14. 31 Oct 2026, 19:03 UTC
    Reported by oss-security · oss-security
  15. 31 Oct 2026, 19:16 UTC
    Reported by Hacker News · Hacker News
  16. 31 Oct 2026, 23:52 UTC
    BleepingComputer reported on it · BleepingComputer

Sources 12 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Security press established security newsrooms

Community discussion sites, treat with care

Technical details

ID
CVE-2026-98432 · ZR-204b171c
CVSS
9.8 / 10
Disclosed
15 Oct 2026, 13:17 UTC
On Zero Radar
29 Oct 2026, 16:57 UTC (14 days after disclosure)
Last change
1 Nov 2026, 07:48 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Linux kernel TCP flaw lets remote attackers run commands as root · Zero Radar