CVSS 9.8 Linux kernel bug CVE-2026-98432 allows remote takeover; Ubuntu still unpatched
NathanpmYoung · x · 2026-11-02
Researchers are flagging CVE-2026-98432, a critical Linux kernel vulnerability (CVSS 9.8): crafted TCP packets can take over a machine with no login required. Ubuntu and Red Hat haven't shipped fixed kernels yet; Debian, SUSE, Oracle and Amazon have.
What to do:
- Check uname -r; fixed versions are 6.1.190+, 6.6.159+, 6.12.113+, 6.18.56+, 7.2.10+ or 7.3+
- Update and reboot if your distro has a fix
- Otherwise mitigate: the attack requires TCP packets with "IP options," which normal traffic never uses — one nftables rule drops them; log drops to spot probing
Anyone renting a server box is likely at risk and should remediate immediately.
Related event: Critical Linux TCP Flaw Enables Remote Root; Most Distros Unpatched(3 posts)→
More from Infra
- AI Defense Agents Running 24/7 Could Send Token Costs Through the Roof — robleclerc · 2026-11-02
- LookAtMyQuant: a quantization compiler with 12x lower KL at Q4_K_M size on Gemma 4 E2B — teortaxesTex · 2026-11-02
- AI Data Centers Near a PC-Style Inflection Point: OCP Analysis of Power, Cooling, Networking — ai · 2026-11-02
- Cerebras halves in 5 months post-IPO: $25.4B order book leans heavily on OpenAI — FinanceYF5 · 2026-11-02
- Together launches post-training platform aligning RL training with serving — togethercompute · 2026-11-02
- Demis Hassabis: AI data centers should be beautiful — Recent_Fox4339 · 2026-11-02