CybersecurityWebsites

How to Check Your Web Server for the Critical Linux TCP Flaw

A 9.8-rated Linux flaw could let attackers take over unpatched servers. Which fixes are out as of Nov. 2, and how a small business checks its web host.

By Cybercave Technologies, LLC · Nov 2, 2026

Row of black server rack doors with red and blue network cables in a data center — Server racks in a data center. Illustration only, not equipment from any company named here. Credit: Photo by Brett Sayles via Pexels (Pexels License).

Short answer: A Linux bug rated 9.8 out of 10 could let an attacker take over an unpatched server over the internet without a password. If your website or online store runs on a Linux server, ask whoever manages it whether the fixed kernel is installed and the server has restarted. As of Nov. 2, 2026, Ubuntu's fix was still in progress.

Key points

The flaw, tracked as CVE-2026-98432, sits in the part of the Linux kernel that handles new IPv4 connections. The kernel is the core of the Linux operating system. The flaw has been there since kernel version 4.4, according to the Linux kernel CVE team's Oct. 15 notice and Akamai's analysis.
On Oct. 27, Anthropic said its AI model Claude wrote a working attack that ran commands with full control (as "root") on Linux servers using a feature called multipath TCP, with no login needed.
Red Hat, Debian and AlmaLinux had fixed kernels out as of Nov. 2. Ubuntu still listed its fix as in progress.
A kernel fix only takes effect after the server restarts.
No attacks using the flaw had been reported as of Nov. 2, 2026, and Anthropic has not released its attack code.

What to do this week: find out who manages the server your website runs on, and ask them in writing whether it has the fixed Linux kernel installed and has been restarted since.

What is the Linux TCP flaw?

It's a timing bug in how Linux handles the first steps of an incoming internet connection. Under the right conditions, the kernel reads memory it has already released, which an attacker can use to crash the server or run their own code.

The Linux kernel CVE team published the flaw on Oct. 15, 2026, and it carries a severity score of 9.8 out of 10 (Critical), as shown on Ubuntu's CVE page and in Akamai's write-up. Red Hat's security bulletin says an attacker needs no account and no action by anyone using the server, and that systems accepting incoming connections are the most directly exposed.

The fix itself went into the main Linux code on Oct. 5, according to Akamai. What matters for a business is whether the company behind your server's version of Linux has shipped it, and whether your server has installed it.

Why are people talking about it now?

Because an AI model built a working attack. In an Oct. 27 research post, Anthropic said Claude, once given initial prompts, produced an exploit allowing a remote attacker to run any command with root access on a Linux server that has a multipath TCP listener open. In Anthropic's test, the attack needed 48 minutes to beat a key kernel defense and five more minutes to run its command, about 53 minutes in all (our calculation). A failed try doesn't crash the server, so an attacker can keep retrying.

Multipath TCP lets one connection use more than one network path. The Go programming language team warned on Oct. 29, in a notice forwarded to the oss-security mailing list, that programs built with Go 1.24 or newer switch it on by default for the connections they listen for. The Go team also said the underlying bug isn't limited to multipath TCP, and that the best fix is a patched kernel.

The Hacker News reported that the kernel patch names Anthropic researcher Xinyang Ge as the person who reported the bug, and that the link to multipath TCP comes from Anthropic's post rather than the CVE record.

Which servers have a fix, as of Nov. 2?

It depends on the version of Linux your server runs. As of Nov. 2, 2026:

Red Hat Enterprise Linux (RHEL) 8, 9 and 10: fixed kernels were released Nov. 1 (for example, Red Hat's RHEL 8 advisory). Red Hat says the system must be restarted for the update to take effect.
Debian: the Debian security tracker lists fixed kernels in the security updates for its current releases.
AlmaLinux 8, 9 and 10: the AlmaLinux project says the fix moved into its regular kernel updates on Nov. 2.
Ubuntu: its CVE page, last updated Oct. 30, listed its releases as vulnerable, with fixes for the newer ones marked "work in progress." Security firm Rescana said in a Nov. 2 update that Ubuntu still had no fixed kernel.

Rescana also reported that no vendor or the kernel CVE team had reported attacks using the flaw. The flaw wasn't in the Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog when we checked on Nov. 2, and Akamai said it wasn't aware of a public working exploit.

Is my small business affected?

Only if something you rely on, such as your website or online store, runs on a Linux server. The next question is who is responsible for updating that server.

Website builder or shared hosting: the provider runs and updates the servers. You can't patch them yourself, but you can ask what they've done.
Your own cloud server or virtual private server (VPS): if you or a freelancer set up a server you rent by the month, updating its operating system may be your job rather than the cloud company's. Check your provider's terms.
Managed hosting or an IT provider: check your agreement. Ask whether kernel updates and restarts are included.

Our example (hypothetical): a Grand Haven gift shop runs its online store on a small cloud server that a freelancer set up a few years ago. Nobody has logged in since. If that server runs Ubuntu, it is waiting on a fix that hasn't shipped, and if it runs another version, the fix may be available but not installed.

How do I check that my web server is patched?

You don't need to be technical for most of this. Your job is to find the right person and get a clear answer in writing.

Find out who manages the server. Look at your hosting invoice or account. "Shared hosting" or a website builder means the provider manages it. A "VPS," "instance" or "cloud server" usually means you or your developer do.
Make sure a recent backup exists. Before any server update, confirm you have a backup you can restore.
Ask which Linux it runs and whether the fix is installed. Name the flaw: CVE-2026-98432.
Ask about the restart. A kernel fix only counts once the server has restarted, so ask when that happened or when it's scheduled. Plan for the site to be briefly offline while it restarts.
If the fix isn't out yet, ask about a stopgap. Red Hat and AlmaLinux describe a temporary firewall rule that blocks the kind of traffic that triggers the bug. Red Hat says it reduces the risk but doesn't replace the update.
Write down the answer and the date. Then check again once Ubuntu or your provider ships the fix.

What should I ask my web host or IT provider?

Ask three questions in writing: Does our website or app run on a Linux server, and which version? Is the fixed kernel for CVE-2026-98432 installed, and has the server been restarted since? If no fix is available yet, what temporary protection is in place, and when will you install the update?

For your IT provider: CVE-2026-98432 (IPv4 TCP use-after-free, kernels 4.4 and later). Upstream fixes: 7.3, plus stable 7.2.10, 6.18.56, 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272. RHEL: RHSA-2026:93414 (RHEL 8), RHSA-2026:93412 (RHEL 9), RHSA-2026:93413 (RHEL 10), reboot required. Debian: DSA-6568-1 and DLA-4841-1. AlmaLinux 10: kernel-6.12.0-211.72.1.el10_2; AlmaLinux 9: kernel-5.14.0-687.64.1.el9_8; AlmaLinux 8: kernel-4.18.0-553.182.1.el8_10. Ubuntu: pending as of Nov. 2. Interim: Red Hat bulletin RHSB-2026-016 nftables rule dropping inbound IPv4 TCP with IP options (ip hdrlength > 5); check net.mptcp.enabled and net.ipv4.tcp_migrate_req; Go 1.24+ services can set GODEBUG=multipathtcp=0. Turning off multipath TCP alone does not prevent exploitation, per Akamai and the Go team. Confirm the running kernel with uname -r after reboot.

What should you do this week?

Send one short message to whoever manages your website's server and ask whether the CVE-2026-98432 fix is installed and the server has been restarted. If the answer is "we're waiting on Ubuntu," ask what temporary protection is in place and put a reminder on your calendar to check again next week.

For more, see our guides to checking that your backups actually restore, the remote tools and servers attackers targeted this month, and installing the October Windows security fix.

FAQ

Do I need to do anything if my site is on a website builder? You can't install the fix yourself, because the provider runs the servers. It's still fair to ask their support team whether they've addressed CVE-2026-98432.

Has anyone been hacked with this flaw? None had been reported as of Nov. 2, 2026. Anthropic has not released its attack code, and Akamai said it wasn't aware of a public working exploit. That can change, which is why the fix matters.

Is turning off multipath TCP enough? No. Akamai and the Go team both say turning it off lowers the risk but doesn't fully prevent an attack. Installing the fixed kernel and restarting is the real fix.

Why does the server need a restart? The kernel is the part of the operating system that is loaded when the server starts. Red Hat's advisory says the system must be rebooted for the update to take effect, and AlmaLinux tells users to confirm the new version after rebooting.

Disclosure: No company or organization named in this article paid for it, reviewed it or saw it before publication. Cybercave Technologies builds, hosts and manages websites for small businesses and offers AI automation services. Fix status is as published by each source and was checked on Nov. 2, 2026. Not sponsored.