CVE-2026-98432: WHICH LINUX KERNELS ARE STILL VULNERABLE

Summary from the TLDR InfoSec newsletter

Mattias Geniar found 712 Multipath TCP listeners on his own Ubuntu 26.04 laptop, opened without his knowledge by Go programs like tailscaled, because Go 1.24 and later enable MPTCP on listening sockets by default. That matters because the only known exploit for CVE-2026-98432 needs an MPTCP listener. The bug is a use-after-free in the kernel's IPv4 TCP handshake that dates back to Linux 4.4 and can be reached with a single SYN. Upstream stable kernels were fixed in mid-October, and Debian, Amazon Linux, and Oracle UEK have shipped patches, but Ubuntu and RHEL still had no fixed kernel as of November 1.