Threat Level Description

IthacaLabs has maintained the Threat Level (High) adding a new observation:

An attack is highly likely. Addressing the broad nature of the threat in order to reach an acceptable risk level, requires additional and sustainable protective security measures combined with specific business and geographical vulnerabilities and judgments.

Description

We have observed a new critical vulnerability in the Linux kernel that can allow remote, unauthenticated attackers to gain root-level access on affected servers.

The critical vulnerability, CVE-2026-98432, affects how the kernel handles incoming IPv4 TCP connection requests. It can be triggered by specially crafted network traffic sent to any listening IPv4 TCP service, before the connection reaches the application, and failed attempts can simply be retried.

Researchers have demonstrated a working exploit that runs commands as root on servers with Multipath TCP (MPTCP) listeners, a feature that recent Go programs enable by default. The exploit has not been released, and the flaw is not currently listed by CISA as known to be exploited. Red Hat, Debian and AlmaLinux have released fixed kernels, while Ubuntu fixes are still pending.

Organizations running Linux servers or cloud workloads that accept IPv4 TCP connections from untrusted networks may be at elevated risk of compromise. Immediate action is recommended to identify exposed systems and apply patched kernels.

Our Advisory and Managed Services, including our Security Operations and Technology Resilience lines, can help safeguard your organization against such threats.

Through proactive monitoring, threat detection, and incident response, our services are designed to keep your systems secure, resilient, and prepared for evolving cyber risks. We advise all organizations to remain vigilant and regularly review their cybersecurity postures.

Affected Products:

• Linux kernel 4.4 and later, including unmaintained branches, before 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3
• Red Hat Enterprise Linux 8, 9 and 10, and OpenShift Container Platform 4 and 5
• Ubuntu 14.04 (some kernels), 16.04, 18.04, 20.04, 22.04, 24.04 and 26.04 LTS, and Ubuntu 26.10
• Debian 12 (linux before 6.1.190-1, linux-6.12 before 6.12.113-1~deb12u1) and Debian 13 (before 6.12.113-1)
• AlmaLinux 8, 9 and 10 kernels before the patched releases

Recommendation(s):

It is highly recommended to apply the patched kernel updates provided by your Linux distribution vendor immediately and reboot affected systems. Organizations should also consider the following measures. The temporary mitigations reduce the risk but do not replace the fixed kernel:

• Treat all unpatched Linux systems that accept IPv4 TCP connections from untrusted networks as exposed.
• Install your distribution's fixed kernel once available and reboot onto it.
• Where patching is not yet possible, drop inbound IPv4 TCP packets carrying IP options on each host, noting that traffic between containers on the same host may bypass it.
• Reapply that rule after every reboot until patched, and confirm it is active. Note that it may disrupt the rare applications that rely on IP options.
• Disable Multipath TCP and TCP request migration where not required, persist the settings and restart services already using it; this reduces but does not remove the risk.
• Check for applications listening on Multipath TCP sockets, including services built with Go 1.24 or later, which enable it by default.
• Ensure incident response teams are prepared to investigate and rebuild any system suspected of compromise.

You should understand the importance of applying security updates with urgency, regardless of organizational size. Implementing an effective patch management strategy, enabling comprehensive event logging, and actively monitoring security events are critical to protecting business-critical assets. A comprehensive risk management approach should include regular penetration testing, at least annually and after significant system changes, to ensure continued compliance with security best practices and industry regulations.

Threat Level Description:

Threat Level: High – An attack is highly likely. Addressing the broad nature of the threat in order to reach an acceptable risk level, requires additional and sustainable protective security measures combined with specific business and geographical vulnerabilities and judgments.

References:

CVE-2026-98432 – NIST National Vulnerability Database

CVE-2026-98432 – CVE Record

CVE-2026-98432 – Ubuntu Security

IthacaLabs Incident Response and Threat Intelligence Services