CVE-2026-98432: 9.8 Kernel Use-After-Free in Ubuntu Proposed – 3-Step Manual Upgrade

Vulnerability Mechanism

The flaw resides in tcp_v4_syn_recv_sock() when establishing IPv4 TCP connections. The kernel transfers ownership of the IP options ( ireq_opt) from the request socket to the child socket without copying them. If a client retransmits a SYN packet, another CPU may read those options after the child socket has already freed them, triggering a use-after-free . This class of memory-safety bug has existed since kernel 4.4.

The race is hard to catch because SYN retransmission is normal TCP behavior. Network jitter causes legitimate retries, so no one suspected a memory-free issue until Anthropic used an AI system (Claude) to systematically scan this code path. The exploit they generated uses MPTCP, but the vulnerability itself is not MPTCP-specific.

Trigger Conditions and Impact

Trigger: Send a connection request with IPv4 Record Route or Timestamp options to any listening TCP port; no authentication required.

Consequence: Remote code execution (RCE).

Affected range: All kernels 4.4 and later; IPv6 main path is unaffected.

Discoverer: Anthropic (Claude-generated exploit not public).

Upstream fix (October): Replaced bare kfree() with kfree_rcu() to defer actual free until after an RCU grace period, closing the race.

A CVSS 9.8 score means an attacker can send a few crafted connection packets to a public-facing TCP service (web, database, load balancer) and potentially gain execution rights without any login or user interaction.

Distribution Fix Status

Red Hat RHEL 8 / 9 / 10: Released — RHSA-2026-93412 / 93413 / 93414

Debian / Oracle / SUSE: Released — October packages

Ubuntu 26.10: Fixed — 7.3.0-10.10

Ubuntu 22.04 LTS: Only -proposed — 5.15.0-203.213

Ubuntu 24.04 LTS: Only -proposed — 6.8.0-149.149

Ubuntu 26.04 LTS: Only -proposed — 7.0.0-43.43

Ubuntu 16.04 / 18.04 / 20.04: Pending — Requires Ubuntu Pro (ESM)

What Is -proposed?

Ubuntu's archive is split into pockets: release (original), updates (regular fixes), security (security patches), backports (newer packages backported), and proposed (candidate packages awaiting test). Packages in proposed are not selected by apt upgrade by default ; you must explicitly request them with -t. This is intentional, giving administrators who want to run their own validation a fast lane.

Canonical's 2026 SRU policy merged the old four-week regular / two-week security cycles into a unified two-week cycle with staggered starts, and kernels now ship weekly. The goal: prevent a 9.8 vulnerability from sitting in the test queue for weeks.

Fix Rollout Path

Current: 22.04, 24.04, 26.04 fixes sit in -proposed; 26.10 already in stable.

Canonical runs regression tests on 2000+ certified servers and devices; cloud, FIPS, and realtime kernel variants are also queued.

After tests pass, packages move to updates; all users receive them via normal updates; blog and CVE status page updated.

16.04, 18.04, 20.04 fixes still in preparation; 20.04 and earlier require Ubuntu Pro (ESM) subscription.

Three-Step Manual Upgrade from -proposed

If you cannot wait for the official push, you can pull the kernel from -proposed yourself. All three commands are required.

Step 1: Enable proposed pocket (main component only)

sudo add-apt-repository --component main --pocket proposed http://archive.ubuntu.com/ubuntu
sudo apt update

Step 2: Explicitly upgrade only the kernel meta-package from -proposed

The -t flag is critical; without it the package will not be selected. The command below finds your installed linux-meta* source package, extracts its binary package name, constructs the pocket name (e.g., jammy-proposed, noble-proposed), and upgrades only the kernel.

dpkg-query -W -f '${source:Package}	${binary:Package}
' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install -t $(. /etc/os-release && echo $VERSION_CODENAME)-proposed --only-upgrade

Step 3: Reboot

sudo reboot

After reboot, run uname -r and verify against the table: 22.04 should show 5.15.0-203, 24.04 6.8.0-149, 26.04 7.0.0-43. dpkg -l 'linux-image*' lists installed kernel packages; confirm the fixed version appears. GRUB defaults to the newest kernel; old kernels remain on disk for rollback if the new one misbehaves.

Three Caveats

Do not disable MPTCP as a workaround. The bug is in the regular IPv4 TCP connection path, not MPTCP-specific. Ubuntu states: security updates are the only appropriate mitigation.

nftables filtering only reduces risk. Dropping inbound TCP packets with IP options blocks the known trigger path, but it cannot stop traffic between containers on the same host and may break legitimate workloads that rely on IP options.

-proposed is a test channel. Installing from it skips Canonical's second-week certification tests; you assume the risk. Publicly exposed machines that rely on the kernel for multi-tenant isolation are candidates for early upgrade; single-user desktops should wait the two weeks for the stable push.

Decision Framework

Ask three questions: (1) Is the machine directly reachable from the public internet? (2) Do its services depend on the kernel itself for isolation? (3) What is the cost of a reboot? If all three are yes, pulling from -proposed is justified. If only the first two apply but downtime is unacceptable, deploy nftables filtering at the perimeter and wait for the updates channel.