Fixes available in -proposed pocket for CVE-2026-98432

Key points

Canonical is testing kernel fixes for CVE-2026-98432, a critical flaw in how the Linux kernel sets up IPv4 TCP connections that can allow remote code execution. Fixed kernels for Ubuntu 22.04 LTS and newer can already be installed from the -proposed pocket. Fixes for older supported releases will follow.

The vulnerability

• Affects the IPv4 TCP connection setup code in Linux kernel 4.4 and later.
• CVSS 3.1 score is 9.8 (Critical), and the impact can be remote code execution.
• The one exploit described so far was generated by Anthropic, is not yet released and uses Multipath TCP (MPTCP). The flaw itself is not limited to MPTCP.
• At the time of writing, no other exploit is known to have been generated or published.

**Status by release (package linux)**

• Trusty 14.04: not affected.
• Xenial 16.04, Bionic 18.04, Focal 20.04: fix pending.
• Jammy 22.04: fix in -proposed, version 5.15.0-203.213.
• Noble 24.04: fix in -proposed, version 6.8.0-149.149.
• Resolute 26.04: fix in -proposed, version 7.0.0-43.43.
• Stonking 26.10: fixed in 7.3.0-10.10.

Release timeline

• The -proposed kernels are offered early under Ubuntu's new SRU strategy for faster CVE fixes. They are meant mainly for users who run their own kernel acceptance tests.
• Canonical is still testing them on more than 2,000 certified servers and devices. After that, the fixes move to the updates pocket and the blog post will be updated.
• The Ubuntu CVE status page has current information.

Checking your system

• Compare the running kernel version with the table above.
• You can also list the installed kernel image packages.

uname -r
dpkg -l 'linux-image*' | grep ^ii

Installing the fix from -proposed

• First enable the -proposed pocket for the main component, which contains the kernel images.
• Packages from -proposed are never upgraded by default, so you must request them for your release.
• If your kernel was installed through a meta-package, run the second set of commands below.
• A reboot is needed afterwards.

sudo add-apt-repository --component main --pocket proposed http://archive.ubuntu.com/ubuntu

sudo apt update
dpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install -t $(. /etc/os-release && echo $VERSION_CODENAME)-proposed --only-upgrade

sudo reboot

Mitigations

• Some sources recommend disabling MPTCP. That advice rests only on the exploit's reported use of MPTCP and does not address the underlying flaw.
• The Ubuntu Security Team considers installing the security updates the only appropriate mitigation.

Support coverage

• Ubuntu 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS get the fix under standard support.
• Ubuntu 20.04 LTS and 18.04 LTS are covered by Expanded Security Maintenance (ESM) through Ubuntu Pro.
• Ubuntu 16.04 LTS and 14.04 LTS need ESM plus the Legacy add-on.
• Ubuntu Pro is free for up to 5 machines, or up to 50 for community members. It also includes Landscape for managing how fixes roll out across many machines.

Summary by DistroNews, based on the original post.