{"id":"EM-20261030-ZO2P","url":"https://cyber.eventmonitor.net/incident/EM-20261030-ZO2P/","type":"cve","title":"Linux Kernel Vulnerability (CVE-2026-98432)","subtitle":"CVE-2026-98432","subject":"CVE-2026-98432","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-10-30T18:03:40.752Z","firstSignal":"2026-10-29T15:57:05.000Z","lastSignal":"2026-11-03T11:23:53.000Z","updated":"2026-11-04T14:43:58.877Z","revision":1,"life":[{"status":"Born","at":"2026-10-30T18:03:40.752Z","why":"second independent source: C123 Provider status pages (Statuspage)"},{"status":"Developing","at":"2026-10-30T18:03:40.752Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-10-29T15:57:05.000Z","what":"First signal: C130 The Hacker News"},{"at":"2026-10-30T18:03:40.752Z","what":"Born: second source, C123 Provider status pages (Statuspage). Page EM-20261030-ZO2P created."},{"at":"2026-11-02T08:00:00.000Z","what":"Source joined: C44 Fortinet PSIRT"},{"at":"2026-11-02T08:00:00.000Z","what":"Severity raised to High by C44"},{"at":"2026-11-03T06:44:52.000Z","what":"Source joined: C159 Mastodon @briankrebs@infosec.exchange"}],"stages":[{"name":"Disclosed","at":"2026-10-29T15:57:05.000Z","detail":"C130 first to name it"},{"name":"Scored","at":"2026-10-29T15:57:05.000Z","detail":"No CVSS yet · EPSS 0.8%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-02T08:00:00.000Z","detail":"C44 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-10-29T15:57:05.000Z","source":"C130","sourceName":"The Hacker News","role":"Research & News","severity":2,"title":"Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions","text":"A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale. Anthropic said on October 27 that its AI model wrote an exploit that uses the flaw to let a remote attacker with no credentials run commands as root on Linux servers with a","url":"https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html"},{"at":"2026-10-30T18:03:40.752Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Akamai: Customer Security Advisory: CVE-2026-98432","text":"investigating. Akamai is aware of the recently published remote code execution CVE-2026-98432. We are actively investigating and taking the appropriate mitigation actions, while we continue to monitor our platform in parallel. We will soon be posting more details for custome","url":"https://stspg.io/n83394y6crxp"},{"at":"2026-10-30T18:10:58.969Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Linode: Customer Security Advisory: CVE-2026-98432","text":"investigating. Akamai is aware of the recently published remote code execution CVE-2026-98432. We are actively investigating and taking the appropriate mitigation actions, while we continue to monitor our platform in parallel. If you have questions or are experiencing an imp","url":"https://stspg.io/9pzh45ps11bv"},{"at":"2026-10-30T21:09:50.252Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Akamai: Customer Security Advisory: CVE-2026-98432","text":"investigating. We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001cIGoWCAW. We will provide an update as we progress.","url":"https://stspg.io/n83394y6crxp"},{"at":"2026-10-30T21:18:23.402Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Linode: Customer Security Advisory: CVE-2026-98432","text":"investigating. We are continuing to investigate this issue. The appropriate subject matter experts are engaged. Subsequent updates around mitigation status will be posted as progress is made.","url":"https://stspg.io/9pzh45ps11bv"},{"at":"2026-10-31T01:55:23.757Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Linode: Customer Security Advisory: CVE-2026-98432","text":"investigating. We are in the process of deploying mitigations for the underlying known attack vector while we continue to analyze any other possible impact. Customers are strongly advised to apply OS updates from their upstream provider to their workloads as soon as those be","url":"https://stspg.io/9pzh45ps11bv"},{"at":"2026-10-31T02:08:43.068Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Akamai: Customer Security Advisory: CVE-2026-98432","text":"investigating. We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001cIGoWCAW. We will provide an update as we progress.","url":"https://stspg.io/n83394y6crxp"},{"at":"2026-11-02T08:00:00.000Z","source":"C44","sourceName":"Fortinet PSIRT","role":"Vendor","severity":3,"title":"Linux kernel RCE CVE-2026-98432","text":"CVSSv3 Score: 9.8 CVE-2026-98432:ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-188"},{"at":"2026-11-02T10:53:30.714Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Akamai: Customer Security Advisory: CVE-2026-98432","text":"investigating. We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001cIGoWCAW. We will provide an update as we progress.","url":"https://stspg.io/n83394y6crxp"},{"at":"2026-11-02T10:55:43.000Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Linode: Customer Security Advisory: CVE-2026-98432","text":"investigating. While we continue to deploy kernel patches across our infrastructure, we have also deployed network rules that drop IPv4 packets with optional headers on public and VPC interfaces. This eliminates the immediate remote attack vector and protects our infrastruct","url":"https://stspg.io/9pzh45ps11bv"},{"at":"2026-11-03T06:44:52.000Z","source":"C159","sourceName":"Mastodon @briankrebs@infosec.exchange","role":"Research & News","severity":1,"title":"Update on the 9.8 CVSS TCP/IP RCE in the Linux kernel (CVE-2026-98432): we've detected what appears to be a threat actor activity scanning t","text":"Update on the 9.8 CVSS TCP/IP RCE in the Linux kernel (CVE-2026-98432): we've detected what appears to be a threat actor activity scanning the entire internet for exposed affected systems. Our own scanning also suggests that the number of potential targets is high, therefore there is an increased likelihood of threat actors attempting to develop exploits for the vulnerability. while CVE-2026-98432","url":"https://infosec.exchange/@malwaretech/117551155941056123"},{"at":"2026-11-03T11:23:53.000Z","source":"C130","sourceName":"The Hacker News","role":"Research & News","severity":2,"title":"Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing","text":"Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can","url":"https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html"}],"crowd":[],"reference":{"nvd":null,"kev":null,"epss":{"epss":0.0076,"pct":0.55396,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}