On November 7 we reported on the Linux kernel TCP handshake flaw CVE-2026-98432 (see that report). At the time Debian, Red Hat and AlmaLinux had fixes out and only Ubuntu still said "work in progress". On November 10 Ubuntu published a batch of kernel security notices, and fixed packages are now in the update archives for 22.04, 24.04 and 26.04. Ubuntu rates the flaw Critical, with a CVSS score of 9.8. If your server runs Ubuntu, the job now is to upgrade the kernel and reboot.

Fixed versions

  • 24.04 (USN-9022-1): generic kernel 6.8.0-149.149, linux-aws 6.8.0-1069.74, linux-azure 6.8.0-1073.82, linux-gcp 6.8.0-1073.81, linux-oracle 6.8.0-1067.71.
  • 22.04 (USN-9027-1): generic kernel 5.15.0-203.213, linux-aws 5.15.0-1120.127, linux-azure 5.15.0-1126.135, linux-gcp 5.15.0-1121.131, linux-kvm 5.15.0-1112.117. If you run a 6.8 cloud kernel on 22.04, see USN-9024-1; linux-aws-6.8, for example, is 6.8.0-1069.74~22.04.1.
  • 26.04 (USN-9018-1): generic kernel 7.0.0-43.43, linux-aws 7.0.0-1017.18. On 26.10 the fix is in 7.3.0-10.10.
  • Not released yet (status on Ubuntu's page as of November 11): the 22.04 HWE kernel linux-hwe-6.8 (pending version 6.8.0-149.149~22.04.1), linux-hwe-7.0 on 24.04 (7.0.0-43.43~24.04.1), and the 5.4 kernel on 20.04 (5.4.0-247.267; 20.04 only gets updates through paid ESM). If you run one of these, keep relying on the temporary rule below.

Upgrade steps

  • Run uname -r to see the current kernel. The suffix after the version, such as -generic, -aws or -azure, tells you which kernel flavour you have; find its fixed version in the list above.
  • Run sudo apt update && sudo apt full-upgrade to install the new kernel. Ubuntu's notice warns that the kernel ABI changed, so third-party kernel modules you built yourself must be recompiled; systems using the standard kernel metapackages handle this automatically during the upgrade.
  • You must reboot afterwards: sudo reboot. Automatic updates (unattended-upgrades) install packages but do not reboot by default, so having them enabled does not mean you are fixed; if the file /var/run/reboot-required still exists, the new kernel is not running. After the reboot, run uname -r again and confirm the version is not lower than the one listed.

If you cannot upgrade yet: Ubuntu's temporary rule

Ubuntu's page for the flaw gives an nftables rule that drops incoming IPv4 TCP packets carrying IP options. Its core is ip protocol tcp ip hdrlength > 5 counter drop, placed on the input chain of a separate table, inet cve_2026_98432 (priority -310). According to Ubuntu, TCP options such as timestamps and window scaling are unaffected, as is IPv6; containers with separate networking need the rule applied separately; and it reduces the risk but does not fully prevent exploitation. Once the kernel is upgraded and the machine rebooted, remove the table with sudo nft delete table inet cve_2026_98432 and delete the matching include line from /etc/nftables.conf. Disabling MPTCP, which we described in the earlier report, is the same kind of stopgap, and whether you turn it back on after the kernel upgrade is your call.

A reminder while you are at it: free support for 20.04 ended long ago, and standard support for 22.04 runs only until April 2027; the upgrade path is in this article. Basic firewall setup is in ufw firewall and SSH key login, and if the server showed unfamiliar processes or logins while it was unpatched, go through our intrusion check and hardening guide.