Linux TCP UAF Checker
CVE-2026-98432 (CVSS 9.8): run the command, paste the output, get your fix.
Command to run on the server
Non-root is fine. Without passwordless sudo the IP-options rule check reports unknown.
Background readingUse-after-freeThe CVE systemThe KEV catalog
Fix status by distribution (2 Nov 2026)
| Distribution | Status | Fixed kernel or note |
|---|---|---|
| Upstream kernel.org | fixed | 7.3, 7.2.10, 6.18.56, 6.12.113, 6.6.159, 6.1.190, 5.15.223, 5.10.272. Lines 4.4 to 5.4 are end of life and get distro fixes only. |
| Ubuntu | no fix | Fixes pending on 2 Nov: 24.04 at 6.8.0-149, 22.04 at 5.15.0-203, 26.04 at 7.0.0-43, 26.10 at 7.3.0-10. 18.04, 20.04 and 16.04 still need a fix. No USN yet. |
| RHEL 8, 9, 10 | fixed | Kernels fixed on 1 Nov: 4.18.0-553.182.1.el8_10 (RHSA-2026:93414), 5.14.0-687.64.1.el9_8 (RHSA-2026:93412), 6.12.0-211.72.1.el10_2 (RHSA-2026:93413). RHEL 6 and 7 are not affected. |
| RHEL 9 kernel-rt and OpenShift | no fix | Still listed as affected on 2 Nov, as are RHEL for NVIDIA and RHCOS images. Bulletin RHSB-2026-016 gives an nftables mitigation. |
| AlmaLinux 8, 9, 10 | testing | 4.18.0-553.180.2.el8_10, 5.14.0-687.61.2.el9_8, 6.12.0-211.69.2.el10_2 in the testing repository since 30 Oct. |
| Debian 12 and 13 | fixed | bookworm 6.1.190-1 (DLA-4841-1) and linux-6.12 6.12.113-1~deb12u1 (DLA-4850-1); trixie 6.12.113-1 (DSA-6568-1). |
| SUSE and openSUSE | mostly fixed | SLES 16.0 and 15 SP4 to SP6 LTSS fixed; 15 SP7 in progress. Leap 16.0 fixed; Leap 15.6 affected. |
| Oracle Linux UEK | fixed | ELSA-2026-500397, -500398 and -500399 for Oracle Linux 7 to 10, 16 Oct. |
| Amazon Linux 2 and 2023 | fixed | Every kernel fixed by 30 Oct, including ALAS2023-2026-3365 and ALAS2-2026-4065. |
How the bug works
Saved IPv4 header options were freed while another CPU could still read them to build a handshake reply, so a client can leak heap data, corrupt memory or crash the kernel.
The fix, "ipv4: free inet_opt and ireq_opt after an RCU grace period," was reported by Xinyang Ge of Anthropic and fixed by Eric Dumazet. IPv6 is not affected by the main issue.
FAQ
Does a web server behind nginx or a container protect me?
No. The bug runs in the host kernel before any application sees the connection, and containers share that kernel. Only a patched kernel plus a reboot removes it.
Why does multipath TCP matter?
Anthropic says its working root exploit targets servers with an MPTCP listener, which Go programs open by default. Plain TCP ports are reachable too.
Will dropping packets with IP options break anything?
No. Normal clients never set IPv4 options. The rule lasts until the next reboot.
Why does Debian need uname -v?
Debian's uname -r hides the patch level; the package version (e.g. 6.1.190-1) is in uname -v, which uname -a includes.
Is my input sent anywhere?
No. The checker runs in your browser.
Status snapshot as of 2 Nov 2026 (Red Hat and Ubuntu re-checked that day; other rows from 31 Oct). Check your distribution's tracker before acting on it.