# Who Is Patched, Who Is Not

CVE-2026-98432 is a race condition / use-after-free in the Linux kernel’s IPv4 TCP handshake, rated CVSS 3.1 9.8 (Critical) and affecting every kernel since 4.4 (2016). Fixed kernels shipped October 11–18 (5.10.272 through 7.3); Red Hat raised it to Critical on October 30 with an nftables stopgap and RHEL fixes on November 1, while Ubuntu was still marked Vulnerable as of November 1 — and Go 1.24+’s default MPTCP pulls Caddy users into scope.

## Key facts

- The kernel CNA scored CVE-2026-98432 at CVSS 3.1 9.8 (Critical).
- The flaw affects all Linux kernels since 4.4, released in 2016.
- Fixed kernels — 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3 — were released between October 11 and October 18.
- Red Hat raised the severity to Critical on October 30, published an nftables interim filtering rule, and pushed RHEL 8/9/10 fixes on November 1.
- Ubuntu was still listed as 'Vulnerable' as of November 1, while Debian, Oracle, Amazon, and SUSE were partially patched.
- Go 1.24 and later enable MPTCP by default, which put Caddy webserver users in scope — the bug is in the kernel, not in Caddy.

Part of the CVE-2026-98432: the kernel flaw a research model exploited — cve 2026 98432 triage guide collection at https://aiservicesmarket.lol/cve-2026-98432/