Ubuntu Still Has No Fixed Kernel for CVE-2026-98432, a 9.8-Scored TCP Use-After-Free With No Public Exploit. Here Is the Triage I'd Run on a Single VPS.
Ubuntu's security tracker still lists CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP code, as "vulnerable, work in progress" for 22.04, 24.04 and 26.04, and as simply vulnerable for 20.04. The upstream fix landed on October 15, which makes today day 19. A lot of solo operators run a VPS on Ubuntu, and the CVSS 9.8 score is going to scare some of them and be ignored by the rest. Neither reaction is right.
What the bug is
The flaw is a race in the IPv4 TCP handshake code. IP options are passed from a request socket to a child socket without being copied, so both point at the same memory, and a concurrent reader can follow a pointer that has already been freed. The fix replaces plain kfree() calls with kfree_rcu() in two destructors so the memory is freed only after a grace period. The upstream commit is e3f33b0. Technical details beyond what Ubuntu's and Debian's trackers state come from a secondary write-up, and I flag that where it matters.
The same write-up says the bug has been present since kernel 4.4 and that a second path opens when net.ipv4.tcp_migrate_req=1 is set or a reuseport eBPF program with migration is attached.
Three scores, one bug
The kernel's CNA scores it 9.8 under CVSS 3.1. Ubuntu gives it a priority of High. Ubuntu's page also lists a CVSS 4.0 base score of 8.3. Red Hat and Amazon Linux reportedly rate it Important, with lower numeric scores.
A 9.8 means "network-reachable, no privileges, high impact" on paper. It does not mean someone has a working attack. According to the secondary write-up, as of October 29 there was no public exploit, no reliable public chain to privilege escalation, and no listing in CISA's Known Exploited Vulnerabilities catalog. The realistic outcome of a hit is a crash, and the race needs connections that carry IPv4 options, which most ordinary server traffic does not.
What the trackers say today
Ubuntu's tracker shows 22.04 as work in progress in 5.15.0-203.213, 24.04 in 6.8.0-149.149 and 26.04 in 7.0.0-43.43, with some variant kernels such as certain hardware-enablement and cloud flavors listed as vulnerable with no fix in progress. Debian's tracker shows fixes shipped for bookworm and trixie. I will not quote Debian version numbers because the tracker page I read listed more than one value for the same release.
The triage I would run on one VPS
Check the kernel first: uname -r, then compare against Ubuntu's tracker, not against upstream version numbers. Upstream numbers like 6.6.159 do not apply to Ubuntu's own kernel packaging.
Then decide whether your server can even be reached by the bug. A server that sits behind a reverse proxy or a managed load balancer and receives ordinary web traffic is a weak candidate for IPv4-option-carrying connections. I would not call it safe, only low on the list.
Set sysctl net.ipv4.tcp_migrate_req to see whether the migration path is open. Setting it to 0 closes only that second path. The main race remains, so do not treat it as a fix.
Finally, set up unattended upgrades for kernel packages if you have not, and subscribe to Ubuntu's security notices so you hear about the fixed kernel the day it ships. When it lands, install it, reboot, and confirm with uname -r.
Where this could be wrong
My exploitability reading rests on a secondary source dated October 29, and the situation can change in a day. If a public exploit appears, or the bug lands in CISA's catalog, my "calm" advice turns into "patch the minute it exists." I also cannot tell you how your cloud provider's network treats IP options, so my low-risk assumption for a proxied server might not hold on yours.
I could be too relaxed about a kernel bug on the internet-facing machine that holds your customers' data. If that describes you, lean toward the careful side.
What I'd actually do
Run the four checks above today, which is about ten minutes. Turn on automatic security updates and a calendar reminder to look at the tracker on Friday. If you run a multi-tenant box or an internet-facing service with unusual networking, watch the tracker daily until Ubuntu ships. Do not migrate distros over this, and do not skip rebooting once the kernel arrives, since an installed kernel does nothing until you boot into it.
Author
Lukas
@lukcombinator