Linux kernel TCP flaw CVE-2026-98432: update and restart servers

MyCERT warns of a critical Linux kernel flaw, CVE-2026-98432, scored 9.8 out of 10, with a working exploit already published. An attacker needs no login. If your company runs its own Linux server, VPS or cloud machine, install the fixed kernel from your distribution and restart. MyCERT says no attacks had been confirmed as of 4 November.

Who needs to act?

This is for businesses that look after their own Linux machines, for example:

• A VPS or cloud server you or your IT vendor manage.
• An in-house Linux server in the office.
• Appliances, containers and ready-made virtual machine images that run their own Linux kernel. MyCERT says these are in scope too.

Office Windows PCs, Macs and phones are not part of this alert.

What is the problem?

According to MyCERT, the bug has been in the kernel since version 4.4 from 2015, so almost every Linux server in use is affected until it is patched. An attacker on the internet does not need a login. The published exploit gets full control of the machine through a feature called Multipath TCP, but MyCERT stresses that the bug itself is in normal TCP handling, so a server without that feature is not automatically safe.

Which versions fix it?

The kernel team fixed it on 5 October 2026, and all maintained kernel branches had the fix by 30 October. MyCERT lists the state of the main Linux distributions as of 4 November:

If your distribution has no fix yet, watch its security page and apply the update as soon as it appears.

What to do

1. Ask whoever manages your server, or check yourself, which Linux distribution and kernel version it runs.
2. Install the fixed kernel package from your distribution as soon as it is released.
3. Restart the server. A kernel update does nothing until the machine restarts.
4. After the restart, check that the new kernel version is running.
5. If the fix is not out yet, limit who can reach the server from the internet, for example by allowing only your office or VPN, and ask your vendor about a stopgap.
6. For NAS boxes and other appliances, check the maker's security page for a firmware update.

How SyncTech can help

Not sure whether a server you rent or run is affected? Contact us through the SyncTech help centre and we can point you to the right update. For websites that should not need server upkeep from you at all, see our business web hosting plans.

Sites and email hosted with SyncTech are already protected: the fix for this flaw is installed and checked on all our hosting servers. You do not need to do anything for them.

Updated 6 November 2026: our hosting servers now run the fixed kernel, checked the same day.

Source and credit

We are sharing this news from MyCERT (CyberSecurity Malaysia). This summary is written by Synctech in our own words.

• MA-1496.112026: MyCERT Alert - Critical Use-After-Free in the Linux Kernel IPv4 TCP Stack Allowing Unauthenticated Remote Code Execution (CVE-2026-98432), MyCERT, 5 November 2026: https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=41402774-707f-4b5a-be88-9e16df822f11

Retrieved 6 November 2026. Linux, Debian, Ubuntu, Red Hat, SUSE, Oracle Linux and Amazon Linux are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.