No impact incident

CloudLinux: CVE-2026-98432 (Linux kernel IPv4 TCP) on CloudLinux OS 8, 9 and 10

Affected: CloudLinux Kernel

Current status of CloudLinux: Operational — live CloudLinux status

Timeline

1. Oct 29, 2026, 18:30 UTC
   investigating
   We are aware of CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP code, and we have confirmed that CloudLinux OS 8, 9, and 10 kernels are affected. Severity ratings differ between vendors: Red Hat currently rates it Moderate, while other vendors rate it higher. The issue requires specific non-default configuration to be triggered, and exploitation is considered complex. The upstream Red Hat fix has not been released yet. A kernel update and a KernelCare livepatch are not available yet. We are tracking the upstream fix and will release updated kernels and live patches for CloudLinux OS 8, 9, and 10 once it is available. We will post updates here as they become available.
2. Oct 30, 2026, 18:37 UTC
   identified
   CVE-2026-98432 (CVSS 9.8, Critical per Red Hat) is a use-after-free flaw in the Linux kernel’s IPv4 TCP code that a remote attacker can reach without an account on the server. Exploiting it means winning a timing race inside the kernel, which is hard to do. Anthropic, which reported the flaw, says its AI model built an exploit that gives remote root on servers with a Multipath TCP listener. Our kernel team couldn’t reproduce that claim. The exploit isn’t public, and no exploitation in the wild has been reported. Affected: CloudLinux 7h, 8, 8 LTS, 9, 9 LTS and 10, and CloudLinux for Ubuntu 22.04. CloudLinux 7 isn’t affected. → Affected CloudLinux versions Multipath TCP: the claimed exploit needs it, and it’s off by default on CloudLinux 8, 9 and 10. The bug itself is in ordinary TCP, so those servers still need the fix. → What the claimed exploit needs Mitigation: none. → Is there a mitigation? Fix status: → Update instructions CloudLinux 7h and 8 kernel: in preparation. AlmaLinux kernel (CloudLinux 9, 10): no fixed kernel yet. Red Hat hasn’t released its fix. LTS kernels (CloudLinux 8 LTS, 9 LTS): fixed kernel in staged rollout. KernelCare livepatch: in preparation for CloudLinux 7h, 8, 9 and 10. CloudLinux for Ubuntu 22.04: Canonical hasn’t released its fix yet. More information can be found here: https://blog.cloudlinux.com/cve-2026-98432-linux-kernel-ipv4-tcp-flaw-status-for-cloudlinux
3. Oct 30, 2026, 23:16 UTC
   identified
   Fixed kernels are available: - CloudLinux 7h and 8: 4.18.0-553.180.1.lve.1 , in staged rollout to production. To install it now: yum update cloudlinux-release yum update 'kernel*' --enablerepo=cloudlinux-rollout-3-bypass reboot - CloudLinux 9: kernel-5.14.0-687.61.2.el9_8 and CloudLinux 10: kernel-6.12.0-211.69.2.el10_2 , in the AlmaLinux testing repository. Red Hat hasn't released its fix yet. Steps to install from AlmaLinux testing are in the blog post. - CloudLinux 8 LTS and 9 LTS: kernel-lts-5.14.0-284.1101.el8.tuxcare.11.els19 and kernel-lts-5.14.0-284.1101.el9.tuxcare.11.els19 , in staged rollout. A regular kernel update installs them once the rollout reaches the server. A reboot is needed to run the fixed kernel. The KernelCare livepatch for CloudLinux 7h, 8, 9 and 10 is still in preparation. CloudLinux for Ubuntu 22.04 is waiting on Canonical's fix. Details in the blog post .
4. Nov 2, 2026, 08:59 UTC
   identified
   KernelCare livepatches for EL8, EL9 and EL10 are on the test feed. We made them ahead of Red Hat. Production and ePortal are next. EL8, including CloudLinux 8: K20261031_0027 to K20261031_0033, test feed since 2026-10-31 14:48 UTC. EL9, including CloudLinux 9: K20261031_0034 to K20261031_0039, test feed since 2026-10-31 16:36 UTC. EL10, including CloudLinux 10: K20261101_0012 to K20261101_0015, test feed since 2026-11-01 07:28 UTC. Covers RHEL, AlmaLinux, Rocky, Oracle Linux, CentOS 8 and CloudLinux kernels. Debian 12 livepatch is ready for release. Debian 13 was released on Oct 26. Tracking: KCARE-33895. Red Hat rates it Critical 9.8. RHEL 8, 9 and 10 are affected. No Red Hat kernel errata yet. Known remote exploit chain is not reachable on EL and CloudLinux in default config. It needs Multipath TCP, and MPTCP is disabled by default (net.mptcp.enabled=0). Our remote reproduction did not trigger the bug on any tested distro, including Debian and Ubuntu, where MPTCP is on. Mitigation until the livepatch is installed: keep net.mptcp.enabled=0. No public exploit code. No exploitation in the wild reported. To check a server: kcarectl --patch-info | grep 'CVE-2026-98432' To install a patch from the test feed: kcarectl --update --prefix=test kcarectl --patch-info --prefix=test | grep CVE-2026-98432
5. Nov 3, 2026, 12:41 UTC
   identified
   Fixed kernels for CloudLinux 9 and 10 are in the CloudLinux stable repositories, so a regular update installs them: - CloudLinux 9: kernel-5.14.0-687.64.1.el9_8 or newer - CloudLinux 10: kernel-6.12.0-211.73.1.el10_2 or newer dnf update 'kernel*' reboot The AlmaLinux testing repository is no longer needed. KernelCare livepatches for this CVE are on the main feed for CloudLinux 7h, 8 and 9 kernels since 2 November, and for CloudLinux 10 kernels since 3 November: - CloudLinux 7h: K20261031_0031 - CloudLinux 8: K20261031_0030 - CloudLinux 9 (AlmaLinux 9 kernels): K20261031_0035 - CloudLinux 10 (AlmaLinux 10 kernels): K20261101_0015 Subscribed servers take the livepatch on their next update cycle, or you can apply it now with no reboot: kcarectl --update To check a server: kcarectl --patch-info | grep CVE-2026-98432 The CloudLinux 7h and 8 kernel 4.18.0-553.180.1.lve.1 and the CloudLinux 8 LTS and 9 LTS kernels are still in staged rollout. Details in the blog post .

Updates as published by CloudLinux (original).