Attackers Started Scanning in the Wild for Linux Kernel RCE Flaw, Ubuntu Releases Fixes

Ubuntu has put early kernel fixes for CVE-2026-98432 in its -proposed pocket for 22.04 LTS and newer releases. The bug is a serious Linux kernel flaw that can let a remote user run commands as root without a login or any user action. The patches are still in testing, so many servers stay open for now.

Canonical’s security team says the flaw sits in how the Linux kernel sets up IPv4 TCP connections, and it affects kernel versions 4.4 and later. The fixed builds are 5.15.0-203.213 for Jammy (22.04), 6.8.0-149.149 for Noble (24.04), and 7.0.0-43.43 for Resolute (26.04). Stonking (26.10) is already fixed in 7.3.0-10.10, and Trusty (14.04) is not affected. Fixes for Xenial, Bionic and Focal are still pending.

Release	Package	Patch status	Fixed kernel version
Trusty (14.04)	linux	Not affected	Not applicable
Xenial (16.04)	linux	Fix pending	Not yet released
Bionic (18.04)	linux	Fix pending	Not yet released
Focal (20.04)	linux	Fix pending	Not yet released
Jammy (22.04 LTS)	linux	Fix available in -proposed	5.15.0-203.213
Noble (24.04 LTS)	linux	Fix available in -proposed	6.8.0-149.149
Resolute (26.04 LTS)	linux	Fix available in -proposed	7.0.0-43.43
Stonking (26.10)	linux	Fixed	7.3.0-10.10

Canonical runs tests on more than 2,000 certified servers and devices before it moves a kernel to the updates pocket. Teams that run their own acceptance tests can install the early builds today, as described in Canonical’s new SRU strategy for faster CVE fixes.

Ubuntu’s CVE-2026-98432 tracker rates the bug 9.8, which is Critical. Its own blog post calls the same score “High,” so readers may see both labels. The record was published on October 15, 2026.

The bug is a use-after-free. In plain terms, the kernel keeps using a piece of memory after it has already let go of it. One CPU frees the IP options of a new connection. Another CPU, handling a repeated SYN packet, still reads them while building a reply. The upstream fix delays that free with kfree_rcu(), so readers finish first.

Anthropic’s Frontier Red Team shared its research on October 27, 2026. It says an unreleased Claude model wrote a working exploit after one first prompt. The exploit targets Linux servers with a multipath TCP (MPTCP) listener.

It works in two stages. First, it makes the kernel send back extra bytes that may hold a kernel pointer, which defeats KASLR, a defense that hides where kernel code sits. Second, it overwrites a callback pointer so the kernel runs a payload and ends in a shell command as root.

A lost race only fails the handshake and does not crash the machine, so the attacker can retry. In the test, the leak took 48 minutes, and the shell took five more.

Cyber Security News covered this in Claude AI Exploits Linux Kernel Flaw to Execute Root Commands Without User Interaction. Our earlier report on Claude building Chrome and Linux exploit chains shows how this fits a wider pattern. Anthropic’s exploit has not been released. It also says this was a lab test and not a real-world incident.

Signs of Scanning in the Wild

Researcher Marcus Hutchins says his team has seen what looks like threat actors scanning the whole internet for affected systems. In a post on X, he reports that residential proxies and Russia-based VPN servers began probing port 443 with MPTCP connections as of November 2.

Normal scanners do not use MPTCP by default, so he strongly suspects this activity targets CVE-2026-98432. His scan on October 30 found about 2,102,043 servers reachable over MPTCP on port 443.

A deeper TLS scan found about 762,774. He says a valid HTTP request is not needed, so the true exposure is likely closer to 2.1 million. These counts show exposure only and do not prove the kernels are unpatched.

There is no public remote code execution exploit yet. Several denial-of-service proofs-of-concept do exist, and they give attackers a starting point.

Some people assumed MPTCP listeners were rare. Hutchins points out that Debian and several other kernels enable MPTCP by default. Go 1.24 and later also bind MPTCP sockets when the kernel allows it, so tools built on Go, such as Caddy, create the needed listener.

Ubuntu emphasizes that the flaw itself is not tied to MPTCP, and the MPTCP link comes only from the Anthropic exploit. Ubuntu’s security team says updates are the only proper fix. Hutchins adds that setting net.mptcp.enabled=0 does not close sockets that are already open, so those apps must restart. You can list MPTCP listeners with sudo ss -Mlnp.

For Admins

Run uname -r and compare the result with the fixed versions above. Ubuntu’s guide to enabling the -proposed pocket explains how to pull in the new kernel, and a reboot is needed afterward. Packages in -proposed are not chosen for upgrade by default, so you must name the pocket when you install.

For hosts that cannot update yet, Ubuntu’s tracker lists an nftables rule that drops incoming IPv4 TCP packets carrying IP options. It reduces risk but does not fully prevent exploitation, and it breaks any connection that relies on IP options.

Ubuntu 20.04 LTS and older need Ubuntu Pro. Focal and Bionic fall under Expanded Security Maintenance, while Xenial and Trusty need the Legacy add-on. Ubuntu Pro is free for up to five machines.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.