[{"data":1,"prerenderedAt":177},["ShallowReactive",2],{"seo-verification":3,"blog-linux-kernel-cve-2026-98432-tcp-ipv4-use-after-free-check-fix-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-linux-kernel-cve-2026-98432-tcp-ipv4-use-after-free-check-fix-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":124,"ctaBody":125,"ctaButton":126,"ctaUrl":127,"relatedPosts":128},534,"linux-kernel-cve-2026-98432-tcp-ipv4-use-after-free-check-fix",{"fr":12,"en":10,"ar":13,"es":14},"linux-noyau-cve-2026-98432-use-after-free-tcp-ipv4-verifier-corriger","ثغرة-نواة-لينكس-cve-2026-98432-use-after-free-tcp-ipv4-التحقق-والإصلاح","kernel-linux-cve-2026-98432-use-after-free-tcp-ipv4-verificar-corregir","CVE-2026-98432: check your VPS kernel with no fix yet","Use-after-free in the Linux kernel's IPv4 TCP stack: status published by Ubuntu and Red Hat on 30 October 2026, check commands, and what to do without a fix.",9,0,false,"2026-10-30T00:00:00+00:00","2026-10-31T01:54:05+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Flinux-noyau-cve-2026-98432-use-after-free-tcp-ipv4-verifier-corriger-poster.svg","CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP stack, published by Ubuntu on 15 October 2026 and updated on 29 October 2026. When we read them on 30 October 2026, the Ubuntu and Red Hat pages gave no confirmed fixed version for the mainstream kernels, and two scores are circulating: 9.8 and 8.1. This guide therefore promises no package number. It shows how to read the status for your distribution, tell the installed kernel from the running one, and decide what to do in the meantime.",[35,39,42,76,79,101,111,114,118,121],{"type":36,"title":37,"body":38},"h2","What the advisory describes, function by function","The Ubuntu page describes a memory-handling flaw in how IPv4 TCP connections are established. When a client sends a SYN, the kernel creates a connection request; at the end of the handshake, `tcp_v4_syn_recv_sock()` creates the child socket. According to the page, this function hands the request's IP options to the child socket without copying them. If a retransmitted SYN is processed at the same moment on another CPU, the kernel can read those already-freed options while building the SYNACK: that is the use-after-free, in `ip_options_build()`.\n\nThe page reports a similar race during request migration between sockets, when `net.ipv4.tcp_migrate_req=1` or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is in place. The fix it describes delays freeing the memory until an RCU grace period has ended, using `kfree_rcu()`, in `inet_sock_destruct()` and `tcp_v4_reqsk_destructor()`. IPv6 is not affected by the first flaw; the page says a similar migration issue exists there and will be handled separately. Keep in mind what it does not say either: remote exploitability is not publicly demonstrated in the pages we read.",{"type":36,"title":40,"body":41},"Two scores, two issuers: 9.8 and 8.1","The two numbers do not contradict each other; they describe different things. Ubuntu shows a High priority and a CVSS 3 score of 9.8, rated Critical. Red Hat publishes a CVSS v3.1 score of 8.1, with the vector `CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H`. The Red Hat page also lists the cve.org value for comparison: 9.8 with `AC:L`. Only the attack complexity changes: low (`AC:L`) on one side, high (`AC:H`) on the other.\n\nRed Hat's 8.1 reflects a tight-timing race, where the attacker has to make two code paths coincide on two CPUs; its description speaks first of a crash, with possible memory corruption. The page states that these scores are preliminary and subject to review. So do not keep a single figure: 9.8 according to Ubuntu, 8.1 according to Red Hat. In the vectors published by Red Hat and cve.org, the flaw is reachable over the network without authentication (`AV:N`, `PR:N`), which is enough to take it seriously without presenting it as an attack under way: neither page we read reports one.",{"type":43,"title":44,"headers":45,"rows":49},"comparison","The published status on 30 October 2026",[46,47,48],"Source or version","Status read on the page","What it means for you",[50,54,57,60,64,68,72],[51,52,53],"Ubuntu 24.04 LTS (noble)","Vulnerable, fix in progress; listed version 6.8.0-149.149","No fixed kernel to install yet",[55,56,53],"Ubuntu 22.04 LTS (jammy)","Vulnerable, fix in progress; listed version 5.15.0-203.213",[58,59,53],"Ubuntu 26.04 LTS","Vulnerable, fix in progress; listed version 7.0.0-43.43",[61,62,63],"Ubuntu 20.04 LTS (focal)","No version listed; check the status on the page","Reopen the page before drawing any conclusion",[65,66,67],"Red Hat","CVSS v3.1 8.1, no mitigation offered, no fixed package listed, Bugzilla 2553390","No official workaround; follow the ticket",[69,70,71],"Debian, AlmaLinux, Rocky and others","Not read for this article","Read your vendor's advisory; do not infer from Ubuntu",[73,74,75],"A version number on an advisory","It is not a fixed version until the status has changed to fixed","Compare `uname -r` with that number only after the status change",{"type":36,"title":77,"body":78},"An installed kernel is not a running kernel","An `apt upgrade` or a `dnf update` drops a new kernel into `\u002Fboot`, but the system keeps running the one loaded at the last boot until it restarts. `uname -r` answers the only question that matters here: which kernel is running right now. The package list answers a different one: which kernels are sitting on disk. When the fix ships, a VPS can therefore show \"up to date\" in its package manager and stay vulnerable for weeks.\n\nThe reverse is true today: installing today's updates does not fix this CVE, because the pages list no fixed kernel. Docker containers change nothing, they share the machine's kernel. On a full virtual machine that kernel is yours; on a container-type VPS it is the host's, and you have to ask the provider. The restart procedure itself is detailed in the PwnEscape and Vghost guide linked under this article, so there is no need to repeat it here.",{"type":80,"title":81,"steps":82},"steps","Check your VPS in ten minutes",[83,86,89,92,95,98],{"title":84,"body":85},"Read the running kernel","`uname -r`\n`cat \u002Fproc\u002Fversion`\nNote the full string, suffix included (`-generic`, `-aws`, `-kvm`, `el9`…). That is what you will compare with your distribution's page, and the suffix tells you which kernel variant to look for.",{"title":87,"body":88},"List installed kernels and any pending restart","Debian, Ubuntu: `dpkg -l 'linux-image*' | grep '^ii'` then `ls \u002Fvar\u002Frun\u002Freboot-required`\nRHEL, AlmaLinux, Rocky: `rpm -q kernel` then `sudo needs-restarting -r`\nIf the newest installed kernel differs from the one `uname -r` reports, a restart is pending.",{"title":90,"body":91},"Look for a published fix","Debian, Ubuntu: `sudo apt update` then `apt list --upgradable 'linux-image*'`\nRHEL, AlmaLinux, Rocky: `sudo dnf updateinfo list --cve CVE-2026-98432` then `sudo dnf check-update kernel`\nAn empty list does not prove you are protected: it only says your repository offers nothing yet.",{"title":93,"body":94},"Read what the candidate package announces","Debian, Ubuntu: `apt changelog \u003Cpackage-listed-in-the-previous-step> | grep -n 'CVE-2026-98432'`\nRHEL, AlmaLinux, Rocky: `sudo dnf updateinfo info --cve CVE-2026-98432`\nIf the identifier appears, the package announces the fix; note its version number and confirm it on your distribution's page before concluding.",{"title":96,"body":97},"Read the network exposure","`sudo ss -4tlnp`\n`sysctl net.ipv4.tcp_migrate_req`\nThe first command lists the IPv4 TCP ports in listening state, so the only places a TCP handshake arrives; that is our reading of the advisory, not a statement from it. The second shows the migration setting (`0` or `1`). That setting does not close the flaw: the first flaw described exists without it.",{"title":99,"body":100},"Reopen the page on the day you decide","Open your distribution's page, note the status of your kernel variant and the last-updated date it shows. Record them with the date you read them: these pages move, and a status read three days ago is not today's status.",{"type":102,"title":103,"items":104},"ul","Acting without a confirmed fix",[105,106,107,108,109,110],"**Close what does not need to be reachable** — every IPv4 TCP port open to the whole Internet is a possible entry. Restrict SSH, databases and administration to the addresses that need them with `ufw` or `firewalld`. That reduces the surface without fixing a public port such as 443.","**Do not count on a workaround** — Red Hat offers none, and the part of the Ubuntu page we read lists none. Setting `net.ipv4.tcp_migrate_req` to `0` does not cover the first flaw described.","**Prepare the restart window** — pick the slot, warn your users, check that your services restart on their own (`systemctl is-enabled \u003Cservice>`) and take a backup or snapshot first.","**Detect the fix as soon as it ships** — run `apt list --upgradable 'linux-image*'` or `dnf check-update kernel` every day, or reread the page. Depending on its configuration, automatic updating installs the kernel without restarting.","**Keep a fallback way in** — locate your provider's emergency console before the restart, not during it: a kernel that fails to come back is handled from there.","**Watch for crashes** — Red Hat describes mainly a crash. `journalctl -k -p err --since '7 days ago'` and `last -x reboot` show an unexpected restart or an unusual kernel message to compare with the publication date.",{"type":36,"title":112,"body":113},"Livepatch: an option, with one condition","A live patch applies a fix to the running kernel without a restart. It exists only once the vendor or the service provider has produced it, and it covers only the CVEs that provider has handled. With Canonical's Livepatch service, `canonical-livepatch status --verbose` lists the applied fixes; on other distributions, third-party services such as KernelCare play that role. The rule is the same everywhere: as long as the identifier CVE-2026-98432 is not in the list of applied fixes, you are not covered, even if the service shows as active.\n\nNone of the pages we read mentions a livepatch for this CVE on the reading date. And a livepatch does not excuse you from the next kernel: still plan the restart to the fixed version, at the slot you will have chosen.",{"type":115,"title":116,"body":117},"tip","Write down the date, not only the status","In your operations notebook, record for each server the running kernel, the status read on the page and the date you read it. In this guide, the status described is that of 30 October 2026; it may have changed by the time you read it. This guide is provided as is: administering your server remains your responsibility, with no support from us.",{"type":36,"title":119,"body":120},"The day a fixed kernel appears","Read the page first: the status of your variant must have changed to fixed and show a version number. The Ubuntu page does not list a single package but several (`linux`, `linux-aws`, `linux-azure`, `linux-gcp`…): follow the line that matches the suffix shown by `uname -r`, not the line of the default `linux` package.\n\nThen install with `sudo apt upgrade` (Debian, Ubuntu) or `sudo dnf upgrade kernel` (RHEL, AlmaLinux, Rocky), restart with `sudo reboot`, and check with `uname -r` that the running string matches the announced fixed kernel. If it still matches the old one, the restart did not switch to the new kernel: look at the default boot entry before declaring the server fixed. Finally, record the installed number in your notebook.",{"type":36,"title":122,"body":123},"The official documentation","Ubuntu page for CVE-2026-98432 (published 15 October 2026, updated 29 October 2026): https:\u002F\u002Fubuntu.com\u002Fsecurity\u002FCVE-2026-98432\n\nRed Hat page for CVE-2026-98432 (CVSS 8.1, Bugzilla 2553390): https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-98432\n\nBoth pages were read on 30 October 2026; they may have changed since.","Root access to install the fixed kernel at the right time","On a ServOrbit.com VPS you have root: you install the fixed kernel as soon as your distribution publishes it and you choose the restart time. The VPS administration option exists for those who prefer not to do it alone; it is an add-on, not included.","See cloud VPS","\u002Fvps-cloud",[129,145,161],{"id":130,"slug":131,"slugs":132,"title":136,"excerpt":137,"readTime":138,"views":18,"isPinned":19,"publishedAt":139,"updatedAt":140,"category":141,"categories":142,"featuredImage":30,"bgImage":31,"posterImage":144,"relatedSolution":30},517,"pwnescape-vghost-linux-kernel-vps-update",{"fr":133,"en":131,"ar":134,"es":135},"pwnescape-vghost-noyau-linux-vps-mettre-a-jour","ثغرتا-pwnescape-و-vghost-تحديث-نواة-لينكس-على-vps","pwnescape-vghost-kernel-linux-vps-actualizar","PwnEscape and Vghost: update the Linux kernel on your VPS","Two Linux kernel flaws from October 2026: PwnEscape is fixed by your host, Vghost on your VPS. Check the kernel, update it and schedule the reboot.",11,"2026-10-28T00:00:00+00:00","2026-10-29T03:10:22+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[143],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fpwnescape-vghost-noyau-linux-vps-mettre-a-jour-poster.svg",{"id":146,"slug":147,"slugs":148,"title":152,"excerpt":153,"readTime":154,"views":18,"isPinned":19,"publishedAt":155,"updatedAt":156,"category":157,"categories":158,"featuredImage":30,"bgImage":31,"posterImage":160,"relatedSolution":30},524,"fragnesia-cve-2026-46300-linux-kernel-php2shell",{"fr":149,"en":147,"ar":150,"es":151},"fragnesia-cve-2026-46300-noyau-linux-php2shell","ثغرة-fragnesia-cve-2026-46300-نواة-لينكس-php2shell","fragnesia-cve-2026-46300-kernel-linux-php2shell","Fragnesia CVE-2026-46300: patch the Linux kernel (PHP2Shell)","Fragnesia (CVE-2026-46300), chained with PHP2Shell, leads to root. Fixed kernels by distribution, esp4\u002Fesp6\u002Frxrpc workaround, checks and traces.",10,"2026-10-29T00:00:00+00:00","2026-10-29T15:45:55+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[159],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Ffragnesia-cve-2026-46300-noyau-linux-php2shell-poster.svg",{"id":162,"slug":163,"slugs":164,"title":168,"excerpt":169,"readTime":17,"views":18,"isPinned":19,"publishedAt":139,"updatedAt":140,"category":170,"categories":174,"featuredImage":30,"bgImage":31,"posterImage":176,"relatedSolution":30},519,"exim-dovecot-patches-mail-server-vps-check-version",{"fr":165,"en":163,"ar":166,"es":167},"exim-dovecot-correctifs-serveur-mail-vps-verifier-version","exim-dovecot-تصحيحات-خادم-البريد-vps-التحقق-من-الإصدار","exim-dovecot-correcciones-servidor-correo-vps-comprobar-version","Exim and Dovecot: check that your package is truly patched","Exim 4.97 can be patched while the upstream fix is 4.100.1. Read the package changelog, test your exposure, restart the daemon, and check the logs.",{"id":138,"name":171,"slug":172,"color":173,"icon":172},"Business Email","emails","bg-cyan-500\u002F10 text-cyan-400",[175],{"id":138,"name":171,"slug":172,"color":173,"icon":172},"\u002Fblog\u002Fcovers\u002Fexim-dovecot-correctifs-serveur-mail-vps-verifier-version-poster.svg",1793414260097]