Who Is Patched, Who Is Not

CVE-2026-98432 is a race condition / use-after-free in the Linux kernel’s IPv4 TCP handshake, rated CVSS 3.1 9.8 (Critical) and affecting every kernel since 4.4 (2016). Fixed kernels shipped October 11–18 (5.10.272 through 7.3); Red Hat raised it to Critical on October 30 with an nftables stopgap and RHEL fixes on November 1, while Ubuntu was still marked Vulnerable as of November 1 — and Go 1.24+’s default MPTCP pulls Caddy users into scope.

Key facts

The kernel CNA scored CVE-2026-98432 at CVSS 3.1 9.8 (Critical).
The flaw affects all Linux kernels since 4.4, released in 2016.
Fixed kernels — 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3 — were released between October 11 and October 18.
Red Hat raised the severity to Critical on October 30, published an nftables interim filtering rule, and pushed RHEL 8/9/10 fixes on November 1.
Ubuntu was still listed as 'Vulnerable' as of November 1, while Debian, Oracle, Amazon, and SUSE were partially patched.
Go 1.24 and later enable MPTCP by default, which put Caddy webserver users in scope — the bug is in the kernel, not in Caddy.