Ubuntu’s CVE-2026-98432 tracker lists four generic kernels as vulnerable

As of November 5, Ubuntu’s CVE tracker lists generic linux kernel targets for Ubuntu 22.04, 24.04, 26.04 and 26.10 as “Vulnerable, work in progress.” Canonical had announced opt-in fixes in the -proposed pocket for the first three releases. Separately, Marcus Hutchins reported apparent MPTCP probing of port 443, with activity said to have begun November 2.

What Hutchins reported about scanning

On November 3, security researcher Marcus Hutchins said his team had detected activity that appeared to scan for systems reachable over MPTCP on port 443. His post describes apparent probing, not a confirmed break-in.

Ubuntu’s generic kernel targets

Ubuntu’s tracker, last updated November 5, marks each of these generic linux entries “Vulnerable, work in progress.” The listed builds are targets for those release packages, not a shared kernel version for every Ubuntu installation. Ubuntu’s CVE tracker

Canonical announced on November 2 that fixes for Ubuntu 22.04, 24.04 and 26.04 were in the opt-in -proposed pocket. That is a testing channel; its packages are not installed automatically as routine updates. The tracker keeps separate entries for cloud, HWE, FIPS and other kernel flavors, so administrators need to match the installed flavor as well as the Ubuntu release. Canonical’s announcement

Checking a running Ubuntu kernel

Use uname -r to identify the kernel currently running, then compare it with the tracker entry for the host’s Ubuntu release and kernel flavor. Installing a kernel package alone does not switch the running system to it; reboot into the intended build and check uname -r again.

To list MPTCP listeners, run sudo ss -Mlnp in the namespace you want to inspect. The command reports listeners in that namespace.

An English-language linuxhint screencast shows terminal checks for a kernel version and MPTCP settings.

The flaw behind the tracker entry

CVE-2026-98432 is a use-after-free in Linux kernel IPv4 TCP connection handling. Ubuntu’s tracker gives it a CVSS 3.1 score of 9.8, rated Critical. The vulnerable path involves a network connection to a listening TCP socket.

Anthropic reported that an unnamed, unreleased internal Claude research model produced a laboratory exploit against a Linux server with an MPTCP listener. In Anthropic’s proof of concept, it took 48 minutes to leak a kernel pointer and five more minutes to reach shell-command execution. The demonstration used MPTCP, while the underlying flaw is in IPv4 TCP; MPTCP is not the full scope of the vulnerability. Anthropic’s account of the demonstration