Two Linux Root Bugs in One Week: One Arrives as a TCP Packet, the Other as a Package Update. Debian Has the APT Fix. Red Hat and Ubuntu Are Still Shipping the Kernel Fix.
Two separate Linux bugs went public in the last week, and both end in root. Neither is known to be exploited in the wild. If you manage Debian or Ubuntu machines, update APT first: Debian has a fix out, and the attack needs only someone sitting between you and a package mirror. For the kernel bug, take your vendor's kernel update the day it reaches you, and read the interim-filter warning below before you apply anything by hand.
The kernel bug: [CVE-2026-98432](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-98432)
Canonical describes it as a flaw in how the Linux kernel sets up IPv4 TCP connections, present in kernel versions 4.4 and later, with a CVSS 3.1 score of 9.8, which is Critical. Red Hat describes the mechanism as a use-after-free: socket options attached to an inbound connection request are freed while another operation is still reading them, through either a retransmitted connection request or a socket migration. A remote attacker with no login can trigger it, and Red Hat says exploitation needs precise timing.
Red Hat lists Red Hat Enterprise Linux 8, 9 and 10 and OpenShift 4 as affected. Canonical says Ubuntu 14.04 is not affected.
The exploit story
Canonical's notice says an unreleased exploit generated by Anthropic is described as using Multipath TCP, and that the vulnerability is not specific to Multipath TCP. It adds that no other exploit is known to have been generated or published. The Hacker News reports that Anthropic said on October 27 that an unreleased internal research model wrote a remote root exploit, and that a proof-only program that triggers the race, with no code execution, is on GitHub. We have read those two sources and not Anthropic's own statement. Disclosure: we use Anthropic's Claude in our work.
None of the sources we read reports an attack in the wild.
Where the fix stands
Vendor | Status as we read it |
Red Hat | Bulletin RHSB-2026-016, updated November 4, rates it Critical and says Red Hat is expediting fixes. It lists no errata. The Hacker News says fixes shipped November 1; the bulletin we read did not show them, so check your subscription. |
Ubuntu 22.04, 24.04, 26.04 | Fixes (5.15.0-203.213, 6.8.0-149.149 and 7.0.0-43.43) are in the opt-in proposed channel, in qualification testing. A reboot is required. |
Ubuntu 26.10 | Listed as fixed in 7.3.0-10.10 |
Ubuntu 16.04, 18.04, 20.04 | Fix pending |
The interim filter, and its warning
Red Hat published an interim filter on October 30 that drops inbound IPv4 TCP packets carrying IP options, which is what the known trigger uses. Red Hat's own warning is the part to keep: the filter is not persistent across a reboot, cannot fully prevent exploitation, may break workloads that depend on IPv4 options, and is no substitute for patching. The exact rule is in the bulletin, and we are not reproducing it here. Test it before you load it on anything that matters.
Canonical makes a separate point worth repeating. Disabling Multipath TCP is being recommended in some places, but the fix is not specific to it, and Canonical's position is that security updates are the only appropriate mitigation.
The package bug: [CVE-2026-109518](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-109518)
Max Justicz reported this one, and Debian published its advisory, DSA-6607-1, on November 4. Debian's wording is that APT can merge two different package downloads after an HTTP redirect gives them the same address, and that improper file handling when resuming an HTTP download lets an attacker on the network replace a package after it has been verified. The result is arbitrary code execution as root.
Ubuntu adds the preconditions. The attacker must be on the path and able to manipulate HTTP traffic between your machine and the archive. APT must follow redirects and retry downloads, which requires a non-zero retry setting. That setting defaults to 3 starting with Debian 12 and Ubuntu 22.04 LTS, so older releases are not affected in a default configuration. Ubuntu rates it High, with a CVSS 4.0 score of 7.7.
Both advisories describe the attack over HTTP. Neither says whether HTTPS package sources are exposed. It is worth noticing that Canonical's own instructions in the kernel notice above use an http:// archive address, so plain-HTTP package mirrors are ordinary, not exotic.
Vendor | Status as we read it |
Debian stable (trixie) | Fixed in APT 3.0.4, per DSA-6607-1 |
Ubuntu | The tracker listed all eight releases from 14.04 to 26.10 as vulnerable, with no fixed versions, when we read it. The Hacker News reports fixed builds, for example 2.4.15ubuntu0.1 on 22.04 and 2.8.4ubuntu0.1 on 24.04. Check the tracker. |
Ubuntu's description implies that setting the retry count to zero would remove one of the preconditions. Neither distribution lists that as a mitigation, so we would test it before relying on it. Update APT.
Which first
This is our view and not a vendor's. The package bug first, because the fix exists today and the precondition, someone able to tamper with your downloads, is the ordinary threat on a coffee-shop network or a compromised mirror path. The kernel bug second, only because most of you cannot patch it yet, and because the sources describe a harder exploit that needs timing. When your vendor's kernel lands, take it.
What we hold
Neither CVE is in our copy of CISA's Known Exploited Vulnerabilities catalog, and we found no indicators of compromise in any source, so there is nothing to ingest. This is a patch story. We read the same advisories everyone else did.
Limits
We read Red Hat's bulletin, Canonical's notice, Ubuntu's tracker page and Debian's advisory, plus The Hacker News's coverage of both bugs. We could not reconcile the Red Hat shipping date or the Ubuntu fixed versions with the vendor pages we read, so we have said which is which. Vendor pages change by the hour. We did not run either bug.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments