Answer Brief
iThome reports that CVE-2026-98432, a 9.8-rated Linux kernel flaw in IPv4 TCP connection handling, affects kernels from 4.4 onward. Remote attackers can reportedly run arbitrary commands as root on servers with MPTCP listeners enabled. Distributions, appliance makers and cloud providers have mixed patch status, with several still investigating or waiting on upstream fixes.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
CVE-2026-98432 surfaced in late October, per iThome; Anthropic disclosed that its Claude AI service wrote a program exploiting it.
- 2
AWS published updated EKS Auto Mode AMIs and an updated Bottlerocket AMI using the patched kernel.
- 3
Veeam repositories began offering updates containing the CVE-2026-98432 fix for Veeam Software Appliance and Veeam Infrastructure Appliance 13.1.
- 4
AWS provided OS patches for RDS/Aurora databases, per the source.
Executive Summary: iThome reports that CVE-2026-98432, a 9.8-rated Linux kernel flaw in IPv4 TCP connection handling, affects kernels from 4.4 onward. Remote attackers can reportedly run arbitrary commands as root on servers with MPTCP listeners enabled. Distributions, appliance makers and cloud providers have mixed patch status, with several still investigating or waiting on upstream fixes.
Why It Matters
The main reason this item matters is the combination of breadth and specificity in iThome's compilation. The source describes CVE-2026-98432 as a 9.8-rated vulnerability in the Linux kernel networking subsystem, in the handling of IPv4 TCP connections. It says the flaw can lead to remote code execution and that it appeared in late October. The source does not state which CVSS version produced the 9.8, so readers should check their own vulnerability scanner or the vendor advisory before comparing it with other scores.
The operational signal is the exploit path. iThome says Anthropic disclosed that its Claude AI service wrote a program that exploits the flaw. According to the source, a remote attacker can target a Linux server with a multipath TCP (MPTCP) listener enabled, send packets, and execute arbitrary commands as root without credentials or user interaction. The source does not describe the exploit's reliability, whether it is public, or whether it has been used in attacks. It does make the threat more concrete than a bare CVE record would.
Technical Signal
Scope is the second half of the story. The source says the vulnerable code exists in kernel versions from 4.4 onward, released in early 2016, so the flaw is nearly 11 years old. That means exposure is not limited to one distribution. iThome groups its findings into Linux distributions, commercial IT products and cloud services. Teams that track only server operating systems will miss the appliances, virtualization platforms, storage systems and backup tools that run a Linux kernel underneath.
Distribution status is uneven. The source lists fixed builds for AlmaLinux, Rocky Linux, Oracle Linux and multiple Red Hat Enterprise Linux streams, and says RHEL 7 and RHEL 6 are not affected. Debian has fixes for some releases, but the listed bookworm and trixie kernels 6.1.176-1 and 6.12.107-1 are marked unpatched. For Ubuntu, 26.10 is listed as fixed, while 26.04 LTS, 24.04 LTS, 22.04 LTS and older releases are listed as in progress; 14.04 LTS is listed as not affected. SUSE has a long list of products in the fixed, unpatched and in-progress categories, so version-level checking is needed.
Operational Impact
Appliance and commercial product status shows the dependency problem. Several vendors wait on upstream kernel fixes. Parallels Secure Workspace depends on an Ubuntu fix, WatchGuard Dimension depends on Ubuntu, and CloudLinux for Ubuntu 22.04 depends on Canonical. Check Point expects its fixes on November 11 through Jumbo Hotfix Accumulators. Peplink lists some Balance/MAX models, AP One models and 5G dongles as unpatched. Parallels says HALB 20.2 will not get a patch because its older operating system no longer receives vendor security updates, and recommends upgrading to a patched HALB release.
Vendor risk statements differ, and readers should keep them separate from the underlying flaw. WatchGuard says its Firebox, Dimension and AP products run vulnerable kernels or Ubuntu versions but do not have MPTCP enabled, so they are not affected by the RCE exploitation chain. ShareTech says its product series do not have the relevant technology enabled and present no immediate risk. Synology rates DSM risk as medium, citing difficult exploitation, no public exploit, no reported in-the-wild attacks and the EPSS model, and expects an update in December. These are vendor assessments, not independent findings. F5, Fortinet and Thales are listed as still investigating.
What To Watch
Cloud guidance depends on who owns the kernel. The source says AWS customers who run their own Linux instances on EC2 and Lightsail must update those kernels themselves. RDS/Aurora and Neptune users should temporarily disable internet access to database ports, while AWS rolled out mitigations and OS patches on November 6. For EKS, customers using managed node groups, self-managed nodes or Karpenter should update to AMI v20261031. ECS existing instances are moved out of workloads 14 days after launch. Google Cloud lists GKE Standard and Autopilot clusters as needing upgrades to specified patched versions, with GKE 1.37 and Ubuntu node image fixes still in progress.
The affected teams are broad. Platform and infrastructure engineers need to map kernel versions and MPTCP listener status. Network and security appliance owners need vendor advisories for firewalls, routers and load balancers. Cloud teams need to separate provider-managed fixes from customer-owned nodes. Backup and storage administrators should review products such as Veeam appliances, NetApp systems and TrueNAS, which appear in the list. Vulnerability managers should record the exposure as dependent on vendor status, not on a single patch.
Risk boundaries matter. It does not say how many systems are exposed, whether attacks are occurring, or whether disabling MPTCP is a sufficient mitigation for every product. A monitoring implication for readers is to check whether MPTCP listeners are enabled before assuming either urgency or safety, and to confirm that against vendor guidance. Vendors that say a product is not affected may refer only to specific versions, so match the exact release.
Next, watch for Ubuntu kernel releases and the downstream products that wait on them, including Parallels Secure Workspace, WatchGuard Dimension and GKE Ubuntu node images. Watch Check Point's November 11 hotfix delivery, Synology's December DSM update, and any change in status from the vendors still investigating. Also watch for public exploit code or exploitation reports, which Synology says had not been reported at the time of its assessment. Because the iThome list is a point-in-time compilation published November 7, 2026, vendor advisories remain the authoritative reference for current status.
Event Type: security
Importance: high
Affected Companies
- Anthropic
- AWS
- Google Cloud
- Red Hat
- SUSE
- Canonical
- Debian
- Check Point
- Veeam
- Synology
- WatchGuard
- Sophos
- F5
- Fortinet
- NetApp
- Peplink
- Parallels
- MikroTik
Affected Sectors
- Linux distributions
- Network appliances
- Cloud services
- Virtualization
- Storage and backup
- Security products
Key Numbers
- Score cited for CVE-2026-98432 (CVSS version not stated in source): 9.8
- Affected Linux kernel versions: 4.4 and later (released early 2016)
- CVE-2026-98432 has existed for: nearly 11 years
- Check Point expected patch date: November 11
- AWS ECS existing instances moved out of workloads after launch: 14 days
Timeline
- CVE-2026-98432 surfaced in late October, per iThome; Anthropic disclosed that its Claude AI service wrote a program exploiting it.
- AWS published updated EKS Auto Mode AMIs and an updated Bottlerocket AMI using the patched kernel.
- Veeam repositories began offering updates containing the CVE-2026-98432 fix for Veeam Software Appliance and Veeam Infrastructure Appliance 13.1.
- AWS provided OS patches for RDS/Aurora databases, per the source.
- iThome published its compiled vendor exposure and patch status list.
Frequently Asked Questions
What is CVE-2026-98432?
According to iThome, it is a 9.8-rated flaw in the Linux kernel networking subsystem, affecting IPv4 TCP connection handling and potentially enabling remote code execution. The source does not state the CVSS version. It says kernels from version 4.4 (early 2016) onward are affected.
What can an attacker do with it?
iThome says remote attackers can target Linux servers that have a multipath TCP (MPTCP) listener enabled. By sending packets, they can reportedly execute arbitrary commands as root, with no credentials or user interaction. The source ties this to Anthropic's disclosure that Claude wrote an exploit program.
Are all vendors patched yet?
No. The source shows mixed status. Many distributions and cloud services have fixes. Others, including some Ubuntu, Debian, SUSE, Peplink and TrueNAS versions, are listed as unpatched or in progress. F5, Fortinet and Thales are listed as still investigating. Check the vendor's own advisory for your exact version.
Does Synology consider DSM at high risk?
Synology rates the practical risk to DSM as medium. It says exploitation is difficult, no public exploit exists, and no vendor or CERT has reported in-the-wild attacks. It also cited the EPSS model. Synology says an update is planned for December.
What should AWS customers do first?
The source says responsibilities vary by service. Customer-managed Linux instances on EC2 and Lightsail need customer kernel updates. RDS/Aurora and Neptune users must temporarily disable internet access to database ports. EKS users should move nodes to AMI v20261031. Review each service's AWS guidance.