Critical Linux Kernel Vulnerability Could Enable Remote Root Access

Executive Summary

A critical vulnerability in the Linux kernel's IPv4 TCP networking implementation, tracked as CVE-2026-98432 (CVSS 9.8), could allow unauthenticated attackers to achieve remote code execution under specific conditions. The flaw involves a race condition leading to a use-after-free memory error. Researchers have demonstrated remote root access in a controlled environment involving Multipath TCP (MPTCP) listeners. Organisations should prioritise kernel updates across affected Linux infrastructure.

Key Details

Affected Platform

Linux kernel versions from the 4.4 branch onward, before the applicable fixed release.

Attack Surface

IPv4 TCP networking stack, particularly systems running exposed MPTCP listeners.

Recommended Action

Apply vendor-provided kernel security updates and reboot affected systems.

Affected Environment

The vulnerability affects multiple Linux kernel branches from version 4.4 onward, prior to their respective security fixes.

Affected environments may include Linux servers, virtual machines, cloud workloads, network appliances and systems running Debian, SUSE, openSUSE or Oracle Linux.

The report identifies fixed upstream kernel versions including 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Distribution-specific security updates may use different version numbering.

Systems running externally accessible MPTCP listeners should receive particular attention.

Operational Impact

Successful exploitation could enable unauthenticated remote code execution with root privileges on vulnerable Linux systems.

Potential consequences include complete server compromise, unauthorised access to sensitive information, malware deployment, persistent attacker access and lateral movement across enterprise networks.

The underlying memory corruption may also cause kernel crashes and service disruption. Although remote root exploitation has been demonstrated under specific MPTCP conditions, the underlying flaw can also affect ordinary TCP connections.

Technical Root Cause

CVE-2026-98432 is a use-after-free vulnerability caused by a race condition in the Linux kernel's IPv4 TCP networking implementation.

Concurrent operations handling TCP connection requests may access memory after it has been released, resulting in memory corruption.

Researchers have demonstrated that the vulnerability can be exploited to achieve remote root access under specific conditions involving MPTCP listeners. The broader networking flaw is not limited exclusively to MPTCP.

Recommended Mitigation

Inventory Linux servers, cloud workloads, virtual machines and network appliances.
Identify systems running vulnerable kernel versions.
Prioritise internet-facing systems and MPTCP-enabled services.
Install the latest applicable kernel security updates.
Reboot updated systems to ensure patched kernels are running.
Restrict unnecessary inbound TCP access through firewall rules.
Consider disabling MPTCP where it is not required, while recognising that this alone does not fully mitigate the vulnerability.
Monitor affected infrastructure for suspicious activity and potential compromise.

Concerned about your exposure?

Our security experts can help you assess affected systems, validate risk and support a safe remediation plan.

Discuss Your Security Exposure Protect Critical Infrastructure from Kernel-Level Threats

Assess your risk

Identify affected systems

Plan remediation

Practical, vendor-aligned guidance

Get expert support

From our 24/7 security team

Stay ahead of emerging threats

Get the latest threat intelligence and security advisories from Smarttech247.

Full Technical Report

Download the complete analysis, including detailed technical findings and references.

Download Full Report (PDF)

References

NIST NVD — CVE-2026-98432

BleepingComputer — Linux kernel remote root vulnerability