Security advisory
Linux kernel IPv4 TCP remote code execution vulnerability (CVE-2026-98432)
Status: Investigating. On October 15, 2026, the Linux kernel project disclosed CVE-2026-98432, a use-after-free flaw in how the kernel handles incoming IPv4 TCP connections. An unauthenticated remote attacker may be able to read kernel memory, crash the system or run code with full privileges. It is rated critical (CVSS 3.1 score 9.8). Researchers have demonstrated remote code execution against servers with Multipath TCP listeners. The Canadian Centre for Cyber Security issued advisory AV26-1108 on October 30, 2026.
Summary
On October 15, 2026, the Linux kernel project disclosed CVE-2026-98432, a use-after-free flaw in how the kernel handles incoming IPv4 TCP connections. An unauthenticated remote attacker may be able to read kernel memory, crash the system or run code with full privileges. It is rated critical (CVSS 3.1 score 9.8). Researchers have demonstrated remote code execution against servers with Multipath TCP listeners. The Canadian Centre for Cyber Security issued advisory AV26-1108 on October 30, 2026.
CVE: CVE-2026-98432
Status: Investigating
Nimble is reviewing whether any of its products, services or systems are affected. Nimble is checking its customer-facing products and services, internal business systems, and hosting provider infrastructure for Linux servers, including Ubuntu, that run an affected kernel version.
This advisory will be updated when the review is complete.
References
- Canadian Centre for Cyber Security, Advisory AV26-1108: cyber.gc.ca
- CVE record CVE-2026-98432: cve.org
- Ubuntu security notice for CVE-2026-98432: ubuntu.com
Questions about this advisory? Contact security@nimble.ca.
Back to the Trust Center