CVE-2026-98432: critical kernel flaw in CloudLinux without full patch

CloudLinux server administrators are facing a new CVE without a complete patch in sight: CVE-2026-98432, a use-after-free vulnerability in the Linux kernel's TCP IPv4 code, with a CVSS score of 9.8 assigned by the kernel CVE team. The flaw is remotely exploitable without requiring an account on the server: any open TCP IPv4 port used for mail, websites or SSH is sufficient.\n\n## What changes for those running hosted services\n\nOn 27 October, Anthropic, which reported the vulnerability, disclosed that they had built an AI model capable of generating an exploit that achieves remote root access on servers with an active Multipath TCP (MPTCP) listener. CloudLinux's kernel team has been unable to reproduce the result, the exploit has not been made public and no active attacks have been reported. On CloudLinux 8, 9 and 10, MPTCP is disabled by default (you can verify with sysctl net.mptcp.enabled), but the bug lies in ordinary TCP: every affected version still requires patching.\n\n## Patch status by version\n\n| Version | Kernel | Kernel patch | KernelCare Livepatch |\n|---|---|---|---|\n| CloudLinux 7 | 3.10 | Not affected | Not required |\n| CloudLinux 7h | 4.18 | In preparation | In preparation |\n| CloudLinux 8 | 4.18 | In preparation | In preparation |\n| CloudLinux 8 LTS | 5.14 (TuxCare ELS) | kernel-lts els19, staged rollout from 30/10 | Not available, kernel required |\n| CloudLinux 9 | 5.14 | Red Hat has not yet released the fix | In preparation |\n| CloudLinux 9 LTS | 5.14 (TuxCare ELS) | kernel-lts els19, staged rollout from 30/10 | Not available, kernel required |\n| CloudLinux 10 | 6.12 | Red Hat has not yet released the fix | In preparation |\n| CloudLinux for Ubuntu 22.04 | 5.15 | Canonical has not yet released the fix | Not available |\n\nThere is no interim mitigation available: Red Hat states that no available option meets its criteria for ease of implementation and stability. For those with the correct kernel already installed, verification is done by comparing uname -r with the build in staged rollout; with KernelCare, once the livepatch is released, use kcarectl --patch-info | grep CVE-2026-98432 (not --info, which does not list CVEs and will show a system as patched when it is not).\n\nIt should be noted that the severity score is not consistent across distributions: CVE-2026-98432 is a use-after-free vulnerability rated 9.8 (Critical) by Ubuntu and 5.9 (Moderate) by Red Hat, though Red Hat's machine-readable advisory has been updated to 8.1. Other distributions have already closed the vulnerability: Amazon Linux 2023 with kernel 6.18 was patched on 24 October and, according to the same tracker, Oracle Linux from 16 October. For CloudLinux users, as of 30 October, versions 7h, 8, 9, 10 and the Ubuntu 22.04 variant still require updating.