Linux Kernel Vulnerability CVE-2026-98432: Temporary Mitigation and Kernel Patching
CVE-2026-98432 is a Linux kernel vulnerability in which kernel code that accepts IPv4 TCP connections reads memory that has already been freed, and the Linux kernel CVE team rated it Critical. Because the flaw can be attacked remotely without authentication, we updated an AlmaLinux 9.8 Lightsail server running Nginx and Apache to the fixed kernel packages, rebooted it, and then confirmed the patch from the running kernel version.
1️⃣ Linux Kernel Vulnerability CVE-2026-98432: How the Flaw Works and What It Affects
When a TCP connection request (SYN) arrives with IPv4 options, the kernel keeps a copy of those options with the pending connection so it can send them back in its reply (SYN-ACK). Once the connection is established, this copy is handed over to the new connection's socket as is, without being duplicated.
If the client sends the SYN again in the meantime, another CPU may be building a SYN-ACK with the same options. If the new connection then closes and the kernel frees the option memory right away, the code that was building the SYN-ACK reads memory that has already been freed, which is a use-after-free.
This code runs while the kernel is handling the connection request, before the application ever sees the connection. So whichever service opened the port, if it is listening over IPv4 TCP, an attack can reach it remotely without credentials, and the score is 9.8 under CVSS 3.1.
The flaw has existed since Linux 4.4, so most Linux servers are affected. Among Lightsail blueprints, the AWS guidance names AlmaLinux 9, CentOS Stream 9, Debian, openSUSE Leap, Ubuntu, Amazon Linux 2 and Amazon Linux 2023. The AlmaLinux announcement lists 8, 9 and 10 as affected, and Lightsail application blueprints such as WordPress and LAMP run on Debian or Ubuntu, so they are affected as well.
FreeBSD and Windows Server, which do not use the Linux kernel, are not affected.
Servers with MPTCP (Multipath TCP) turned off still need the patch. The published exploit targeted servers with an open MPTCP listener, but the flaw itself is in the regular IPv4 TCP code, so the AlmaLinux announcement also states that systems without MPTCP must be fixed too.
The fixed kernel frees the option memory only after an RCU grace period has passed, so the memory stays in place while another CPU is reading the options to build a SYN-ACK.
2️⃣ Checking the Linux Kernel Version: Is the Kernel Fixed?
Whether a patch is needed depends on the running kernel version, so before updating we first checked the distribution and the kernel version.
cat /etc/os-releaseNAME="AlmaLinux"
VERSION="9.8 (Olive Jaguar)"
ID="almalinux"
ID_LIKE="rhel centos fedora"
VERSION_ID="9.8"
PLATFORM_ID="platform:el9"
PRETTY_NAME="AlmaLinux 9.8 (Olive Jaguar)"
ANSI_COLOR="0;34"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:almalinux:almalinux:9::baseos"
HOME_URL="https://almalinux.org/"
DOCUMENTATION_URL="https://wiki.almalinux.org/"
BUG_REPORT_URL="https://bugs.almalinux.org/"
ALMALINUX_MANTISBT_PROJECT="AlmaLinux-9"
ALMALINUX_MANTISBT_PROJECT_VERSION="9.8"
REDHAT_SUPPORT_PRODUCT="AlmaLinux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.8"
SUPPORT_END=2032-06-01uname -r5.14.0-687.55.1.el9_8.x86_64nft --version-bash: nft: command not foundThe distribution was AlmaLinux 9.8 and the running kernel was 5.14.0-687.55.1.el9_8. The nft command used for the temporary blocking rule was also missing, so the nftables package was not installed.
rpm -q kernelkernel-5.14.0-611.30.1.el9_7.x86_64
kernel-5.14.0-687.49.1.el9_8.x86_64
kernel-5.14.0-687.55.1.el9_8.x86_64[rpm -q kernel] lists the installed kernels, but until you reboot, the only one actually running is the one shown by [uname -r]. Compare this version with the fixed version in the AlmaLinux announcement.
| Distribution | Fixed kernel version (this version or later) |
|---|---|
| AlmaLinux 8 | kernel-4.18.0-553.182.1.el8_10 |
| AlmaLinux 9 | kernel-5.14.0-687.64.1.el9_8 |
| AlmaLinux 10 | kernel-6.12.0-211.72.1.el10_2 |
5.14.0-687.55.1.el9_8 was lower than 5.14.0-687.64.1.el9_8, the fixed version for AlmaLinux 9, so it needed the update.
To see whether a path for the attack was open, we checked the listening IPv4 TCP ports and the MPTCP status.
ss -lnt4State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 511 0.0.0.0:443 0.0.0.0:*
LISTEN 0 511 0.0.0.0:80 0.0.0.0:*sysctl net.mptcp.enablednet.mptcp.enabled = 0ss -lnMState Recv-Q Send-Q Local Address:Port Peer Address:PortThe IPv4 TCP ports listening on all addresses (0.0.0.0) were 80 and 443 for the web server and 22 for SSH.
[net.mptcp.enabled] was 0 and there were no MPTCP sockets, so the MPTCP path used by the published exploit was closed. The flaw starts from regular IPv4 TCP connections, though, so a server listening on three IPv4 ports still needs the patch.
3️⃣ Linux Kernel Update: Seven Kernel Packages and a Reboot
Before changing the kernel, we created a manual snapshot of the instance in the Lightsail console. Lightsail has no screen for choosing which kernel to boot, so if the server does not come up with the new kernel, you restore it by creating a new instance from this snapshot.
🔲 Lightsail Snapshot Simulator
Linux 기반 블루프린트를 사용하는 인스턴스에 취약점(CVE-2026-98432)이 발생할 수 있습니다. 인스턴스가 영향을 받는지 확인하고 사용 중인 Linux 배포판에 최신 보안 업데이트를 적용하는 것이 좋습니다.
(us-east-1a)
스냅샷을 생성하여 인스턴스, 해당 시스템 디스크 및 연결된 디스크를 백업할 수 있습니다.
일일 스냅샷 시간은 오전 5:00 GMT+0입니다.Amazon은 가장 최근의 스냅샷 7개를 저장합니다.
🔲 Checking the Linux Kernel Update and Reboot
We checked the fixed kernel version available in the repository with a dnf listing.
dnf --showduplicates list available kernel kernel-core kernel-modules kernel-modules-core kernel-tools kernel-tools-libs kernel-headerskernel.x86_64 5.14.0-687.64.1.el9_8 baseos
kernel-core.x86_64 5.14.0-687.64.1.el9_8 baseos
kernel-modules.x86_64 5.14.0-687.64.1.el9_8 baseos
kernel-modules-core.x86_64 5.14.0-687.64.1.el9_8 baseos
kernel-tools.x86_64 5.14.0-687.64.1.el9_8 baseos
kernel-tools-libs.x86_64 5.14.0-687.64.1.el9_8 baseos
kernel-headers.x86_64 5.14.0-687.64.1.el9_8 appstreamdnf download kernel-core-5.14.0-687.64.1.el9_8This downloads only the kernel-core package file into the current folder and does not install it.
rpm -Kv kernel-core-5.14.0-687.64.1.el9_8.x86_64.rpm V4 RSA/SHA256 Signature, key ID b86b3716: OKrpm -qp --changelog kernel-core-5.14.0-687.64.1.el9_8.x86_64.rpm | grep CVE-2026-98432- ipv4: free inet_opt and ireq_opt after an RCU grace period (CKI Backport Bot) [RHEL-295635] {CVE-2026-98432}The signature was OK, and the changelog had a line fixing CVE-2026-98432. The dnf security advisories (updateinfo) we checked on November 3 did not list this CVE yet, so [dnf upgrade --security] could not fetch this kernel.
So we installed the seven kernel packages, specifying each version.
dnf install -y kernel-5.14.0-687.64.1.el9_8 kernel-core-5.14.0-687.64.1.el9_8 kernel-modules-5.14.0-687.64.1.el9_8 kernel-modules-core-5.14.0-687.64.1.el9_8 kernel-tools-5.14.0-687.64.1.el9_8 kernel-tools-libs-5.14.0-687.64.1.el9_8 kernel-headers-5.14.0-687.64.1.el9_8================================================================================
Package Architecture Version Repository Size
================================================================================
Installing:
kernel x86_64 5.14.0-687.64.1.el9_8 baseos 1.1 M
kernel-core x86_64 5.14.0-687.64.1.el9_8 baseos 17 M
kernel-modules x86_64 5.14.0-687.64.1.el9_8 baseos 40 M
kernel-modules-core x86_64 5.14.0-687.64.1.el9_8 baseos 31 M
Upgrading:
kernel-headers x86_64 5.14.0-687.64.1.el9_8 appstream 2.6 M
kernel-tools x86_64 5.14.0-687.64.1.el9_8 baseos 1.3 M
kernel-tools-libs x86_64 5.14.0-687.64.1.el9_8 baseos 1.1 M
Removing:
kernel x86_64 5.14.0-611.30.1.el9_7 @baseos 0
kernel-core x86_64 5.14.0-611.30.1.el9_7 @baseos 64 M
kernel-modules x86_64 5.14.0-611.30.1.el9_7 @baseos 33 M
kernel-modules-core x86_64 5.14.0-611.30.1.el9_7 @baseos 27 M
Transaction Summary
================================================================================
Install 4 Packages
Upgrade 3 Packages
Remove 4 Packages
Total download size: 94 M
Complete!Four new kernel packages were installed, the three packages kernel-headers, kernel-tools and kernel-tools-libs were upgraded, and no other packages changed. Because the [installonly_limit=3] setting keeps up to three installed kernels, the four packages of the oldest kernel, 5.14.0-611.30.1.el9_7, were removed, and it took 74 seconds from download to completion.
The official command given in the AlmaLinux announcement refreshes the repository data and then upgrades every package that has an update.
sudo dnf clean metadata && sudo dnf upgradeBecause packages other than the kernel are upgraded as well, the steps for upgrading the whole distribution version are covered in Alma Linux update: 9.4 → 9.8 in LightSail.
The new kernel takes effect only after a reboot.
systemctl rebootAfter the server came back up, we checked the running kernel, the installed kernels and the default kernel in turn.
uname -r5.14.0-687.64.1.el9_8.x86_64rpm -q kernelkernel-5.14.0-687.49.1.el9_8.x86_64
kernel-5.14.0-687.55.1.el9_8.x86_64
kernel-5.14.0-687.64.1.el9_8.x86_64grubby --default-kernel/boot/vmlinuz-5.14.0-687.64.1.el9_8.x86_64The server came back up less than a minute after the reboot command, and both the running kernel and the default kernel for the next boot changed to 5.14.0-687.64.1.el9_8. The previous kernel, 5.14.0-687.55.1.el9_8, is still installed, so if the new kernel causes problems, you can switch the default kernel back.
| Item | Before patch | After patch |
|---|---|---|
| Running kernel (uname -r) | 5.14.0-687.55.1.el9_8 | 5.14.0-687.64.1.el9_8 |
| Default kernel (grubby) | 5.14.0-687.55.1.el9_8 | 5.14.0-687.64.1.el9_8 |
| Installed kernels (rpm -q kernel) | 5.14.0-611.30.1.el9_7, 5.14.0-687.49.1.el9_8, 5.14.0-687.55.1.el9_8 | 5.14.0-687.49.1.el9_8, 5.14.0-687.55.1.el9_8, 5.14.0-687.64.1.el9_8 |
4️⃣ Temporary Mitigation Before Rebooting: nft Rules and Their Limits
If you cannot reboot right away, you can block the packets that trigger the flaw with a temporary rule until the fixed kernel is in place. The commands in this section were not run by us; they follow the official guidance (the AlmaLinux and AWS announcements).
On the Nginx and Apache AlmaLinux 9.8 Lightsail server, a reboot takes only a few minutes, so we updated the kernel right away without the temporary mitigation.
The flaw is triggered only by TCP connection requests that carry IPv4 options. Normal traffic rarely uses IPv4 options, so blocking only IPv4 TCP packets with options leaves ordinary connections working as usual.
sudo dnf install -y nftablesThe nft command is part of the nftables package, which is installed together with firewalld. If the command is missing on your server, install it first.
sudo nft -f - <<'EOF'
add table ip cve_2026_98432
delete table ip cve_2026_98432
table ip cve_2026_98432 {
chain prerouting {
type filter hook prerouting priority -300; policy accept;
meta l4proto tcp ip hdrlength > 5 counter drop
}
}
EOFThis creates a table that drops TCP packets whose IPv4 header length is greater than 5, that is, packets with IPv4 options, at the prerouting stage. AlmaLinux tested this rule on 8, 9 and 10; it can be used together with firewalld and is safe to run more than once.
sudo nft list table ip cve_2026_98432This checks that the rule is in place; the counter value in the output is the number of packets dropped so far.
sudo nft delete table ip cve_2026_98432After rebooting into the fixed kernel, delete the table with this command.
This rule disappears on reboot, so if you rebooted before installing the fixed kernel, run the command that creates the table again.
This rule does not suit servers with applications that rely on IPv4 options. Networks that use CIPSO security labels (NetLabel), which are carried in IPv4 options, are one example; they are not used in the default configuration.
The rule protects the host and containers that receive traffic through the host (the default mode for Podman and Docker). Traffic exchanged between containers on the same host can bypass this rule.
On Debian, Ubuntu and openSUSE, use the one-line iptables rule from the AWS guidance. The AlmaLinux 9 and CentOS Stream 9 kernels lack the u32 match this rule uses, so use the nft rule above instead.
sudo iptables -I INPUT 1 -p tcp -m u32 --u32 '0>>24&0x0f=6:15' -j DROPThe u32 expression reads the IPv4 header length field; a value greater than 5 means the packet carries IPv4 options. After installing the fixed kernel, remove this rule with the command below.
sudo iptables -D INPUT -p tcp -m u32 --u32 '0>>24&0x0f=6:15' -j DROPClosing unused ports in the Lightsail firewall and limiting the remaining ones to trusted IP addresses is another measure recommended in the AWS guidance.
🔢 FAQ & Recommended Content
Kernel version
Linux Kernel Version Check Commands and How to Check the Distribution Version
On Linux, you can check the kernel version with the uname command.
ℹ️ Affiliate Disclosure
This site's content contains affiliate links. When a visitor buys a product or service through one of them, the site receives a commission from the seller. The amount the buyer pays(it goes down during event discounts ↓)does not go up. Posted prices, discounts, and stock reflect the time of writing and may differ, so confirm with the seller before buying. Products are chosen and reviewed by our own standards, and commissions do not affect the order or content of reviews.