{"id":"EM-20261102-ZO2P","url":"https://cyber.eventmonitor.net/incident/EM-20261102-ZO2P/","type":"cve","title":"Linux Kernel Vulnerability (CVE-2026-98432)","subtitle":"CVE-2026-98432","subject":"CVE-2026-98432","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-02T08:00:00.000Z","firstSignal":"2026-10-29T15:57:05.000Z","lastSignal":"2026-11-03T11:23:53.000Z","updated":"2026-11-04T11:50:01.554Z","revision":5,"life":[{"status":"Born","at":"2026-11-02T08:00:00.000Z","why":"second independent source: C44 Fortinet PSIRT"},{"status":"Developing","at":"2026-11-02T08:00:00.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-10-29T15:57:05.000Z","what":"Source joined: C130 The Hacker News"},{"at":"2026-10-30T18:03:40.752Z","what":"First signal: C123 Provider status pages (Statuspage)"},{"at":"2026-10-31T19:16:30.000Z","what":"Source joined: C161 Hacker News (security stories)"},{"at":"2026-11-02T08:00:00.000Z","what":"Born: second source, C44 Fortinet PSIRT. Page EM-20261102-ZO2P created."},{"at":"2026-11-02T08:00:00.000Z","what":"Severity raised to High by C44"},{"at":"2026-11-03T06:44:52.000Z","what":"Source joined: C159 Mastodon @briankrebs@infosec.exchange"}],"stages":[{"name":"Disclosed","at":"2026-10-15T13:17:13.987Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-10-15T13:17:13.987Z","detail":"CVSS 9.8 · EPSS 0.8%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-02T08:00:00.000Z","detail":"C44 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-10-29T15:57:05.000Z","source":"C130","sourceName":"The Hacker News","role":"Research & News","severity":2,"title":"Linux Kernel TCP Flaw With 9.8 CVSS Score Affect  Ubuntu, Red Hat and Other Di tribution","text":"A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale. Anthropic said on October 27 that its AI model wrote an exploit that uses the flaw to let a remote attacker with no credentials run commands as root on Linux servers with a","url":"https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html"},{"at":"2026-10-30T18:03:40.752Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Akamai: Cu tomer Security Advi ory: CVE-2026-98432","text":"investigating. Akamai is aware of the recently published remote code execution CVE-2026-98432. We are actively investigating and taking the appropriate mitigation actions, while we continue to monitor our platform in parallel. We will soon be posting more details for custome","url":"https://stspg.io/n83394y6crxp"},{"at":"2026-10-30T18:10:58.969Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Linode: Cu tomer Security Advi ory: CVE-2026-98432","text":"investigating. Akamai is aware of the recently published remote code execution CVE-2026-98432. We are actively investigating and taking the appropriate mitigation actions, while we continue to monitor our platform in parallel. If you have questions or are experiencing an imp","url":"https://stspg.io/9pzh45ps11bv"},{"at":"2026-10-30T21:09:50.252Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Akamai: Cu tomer Security Advi ory: CVE-2026-98432","text":"investigating. We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001cIGoWCAW. We will provide an update as we progress.","url":"https://stspg.io/n83394y6crxp"},{"at":"2026-10-30T21:18:23.402Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Linode: Cu tomer Security Advi ory: CVE-2026-98432","text":"investigating. We are continuing to investigate this issue. The appropriate subject matter experts are engaged. Subsequent updates around mitigation status will be posted as progress is made.","url":"https://stspg.io/9pzh45ps11bv"},{"at":"2026-10-31T01:55:23.757Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Linode: Cu tomer Security Advi ory: CVE-2026-98432","text":"investigating. We are in the process of deploying mitigations for the underlying known attack vector while we continue to analyze any other possible impact. Customers are strongly advised to apply OS updates from their upstream provider to their workloads as soon as those be","url":"https://stspg.io/9pzh45ps11bv"},{"at":"2026-10-31T02:08:43.068Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Akamai: Cu tomer Security Advi ory: CVE-2026-98432","text":"investigating. We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001cIGoWCAW. We will provide an update as we progress.","url":"https://stspg.io/n83394y6crxp"},{"at":"2026-10-31T19:16:30.000Z","source":"C161","sourceName":"Hacker News (security stories)","role":"Research & News","severity":1,"title":"TCP U e-After-Free: CVE-2026-98432 / CVSS 9.8","text":"748 points on Hacker News","url":"https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf"},{"at":"2026-11-02T08:00:00.000Z","source":"C44","sourceName":"Fortinet PSIRT","role":"Vendor","severity":3,"title":"Linux kernel RCE CVE-2026-98432","text":"CVSSv3 Score: 9.8 CVE-2026-98432:ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq","url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-188"},{"at":"2026-11-02T10:53:30.714Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Akamai: Cu tomer Security Advi ory: CVE-2026-98432","text":"investigating. We are continuing to investigate this issue. Customers and partners can find more details on the Akamai Community: https://community.akamai.com/customers/s/feed/0D5a700001cIGoWCAW. We will provide an update as we progress.","url":"https://stspg.io/n83394y6crxp"},{"at":"2026-11-02T10:55:43.000Z","source":"C123","sourceName":"Provider status pages (Statuspage)","role":"Provider Status","severity":1,"title":"Linode: Cu tomer Security Advi ory: CVE-2026-98432","text":"investigating. While we continue to deploy kernel patches across our infrastructure, we have also deployed network rules that drop IPv4 packets with optional headers on public and VPC interfaces. This eliminates the immediate remote attack vector and protects our infrastruct","url":"https://stspg.io/9pzh45ps11bv"},{"at":"2026-11-03T06:44:52.000Z","source":"C159","sourceName":"Mastodon @briankrebs@infosec.exchange","role":"Research & News","severity":1,"title":"Update on the 9.8 CVSS TCP/IP RCE in the Linux kernel (CVE-2026-98432): we've detected what appear  to be a threat actor activity  canning t","text":"Update on the 9.8 CVSS TCP/IP RCE in the Linux kernel (CVE-2026-98432): we've detected what appears to be a threat actor activity scanning the entire internet for exposed affected systems. Our own scanning also suggests that the number of potential targets is high, therefore there is an increased likelihood of threat actors attempting to develop exploits for the vulnerability. while CVE-2026-98432","url":"https://infosec.exchange/@malwaretech/117551155941056123"},{"at":"2026-11-03T11:23:53.000Z","source":"C130","sourceName":"The Hacker News","role":"Research & News","severity":2,"title":"Red Hat Patche  9.8-Rated Linux TCP RCE Flaw While Ubuntu Relea e  Fixe  for Te ting","text":"Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can","url":"https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html"}],"crowd":[],"reference":{"nvd":{"published":"2026-10-15T13:17:13.987","score":9.8,"severity":"CRITICAL","desc":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the\nchild socket (newinet->inet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmit","product":"","seen":1793783074499},"kev":null,"epss":{"epss":0.0076,"pct":0.55326,"at":1793783074499},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}