Ubuntu Releases Early Fixes for Linux Kernel RCE Flaw
Original title: Attackers Started Scanning in the Wild for Linux Kernel RCE Flaw, Ubuntu Releases Fixes
Ubuntu provides early kernel fixes for CVE-2026-98432 allowing root RCE via use-after-free in TCP connections; attackers scanning in the wild for affected systems.
Ubuntu has put early kernel fixes for CVE-2026-98432 in its -proposed pocket for 22.04 LTS and newer releases. The bug is a serious Linux kernel flaw that can let a remote user run commands as root. The patches are still in testing. Canonical’s security team says the flaw sits in how the Linux kernel sets up IPv4 TCP connections and affects kernel versions 4.4 and later. Researcher Marcus Hutchins reports scanning activity on port 443 with MPTCP connections as of November 2.
Unconfirmed: Exploitation status unconfirmed beyond scanning; no public remote code execution exploit released
- Fix available in -proposed for Jammy 5.15.0-203.213
- Noble 6.8.0-149.149
- Resolute 7.0.0-43.43
- Stonking already fixed
- NFTables rule drops IP options
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×25 |
From the original article
4 min read at cybersecuritynews.com
Ubuntu has put early kernel fixes for CVE-2026-98432 in its -proposed pocket for 22. 04 LTS and newer releases. The bug is a serious Linux kernel flaw that can let a remote user run commands as root without a login or any user action.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.