How to protect Ubuntu servers from CVE-2026-98432

On 4 November Ubuntu 22.04 and 24.04 still had no released fix for CVE-2026-98432, a critical flaw in Linux kernels from 4.4 onwards. Debian and Amazon Linux were already shipping fixed kernels. To protect an Ubuntu server, check which kernel is running, plan a reboot for the day the fix is released and, on a server reachable from the internet, add a firewall rule until then. On Debian and Amazon Linux, update and reboot now.

The Linux kernel security team disclosed the flaw on 15 October. Without logging in, an attacker can use it to corrupt kernel memory while a TCP connection over IPv4 is being set up. The kernel team and Ubuntu rate it 9.8 on CVSS 3.1. Ubuntu says it can lead to remote code execution, meaning an attacker could run their own code on the server.

Which systems already have a fixed kernel

AWS’s security bulletins date the first Amazon Linux 2023 fix to 24 October and the Amazon Linux 2 fix to 30 October. Debian 12 and 13 have fixed kernels in the security repository, part of the default apt sources.

On 2 November Canonical wrote that the fixes for 22.04 and newer are in -proposed while it tests them, and will go out to regular updates “as soon as those tests are complete”. It gave no date.

CISA had not added the flaw to its list of known exploited vulnerabilities by 4 November, so it had not publicly confirmed any attacks.

The new kernel only runs after a reboot

Ubuntu applies security updates on its own with unattended-upgrades. It does not reboot, though, because Unattended-Upgrade::Automatic-Reboot defaults to false. The new kernel lands on disk while the server keeps running the old one until someone restarts it. With php2shell restarting PHP was enough; a new kernel needs the whole server rebooted.

On release day, do not wait for unattended-upgrades: run sudo apt update && sudo apt upgrade and reboot. To have future kernels take effect on their own, reboot once by hand and check that every service comes back, then set Automatic-Reboot to true and Automatic-Reboot-Time to a quiet hour. The server then reboots at that hour only when an update needs it.

Run these on the host, since a container has its own packages.

# Ubuntu 22.04 and 24.04
# the kernel running now
uname -r
# kernels installed on disk
dpkg -l 'linux-image*' | grep '^ii'
# if present, a reboot is pending
ls /var/run/reboot-required

For common kernels, the Ubuntu tracker gives these fixed versions, or newer: 6.8.0-149 for the generic kernel on 24.04, 6.8.0-1069 on 24.04 with the linux-aws 6.8 kernel and 5.15.0-203 for the generic kernel on 22.04. For other lines, such as HWE, Azure, GCP, 26.04 or 6.8 on 22.04, use the tracker row with the same ending as your uname -r, such as -generic or -aws, and the same leading number, like 6.8.0. The 6.17 kernel on 24.04 has no fix yet.

A firewall rule while you wait

Red Hat’s bulletin RHSB-2026-016 of 30 October has a ready-to-copy nftables rule that drops incoming TCP packets with IPv4 options. Red Hat adds that the filter “is not a substitute for patching”. Once the server is running the fixed kernel, remove the rule with nft delete table inet cve_2026_98432.

The rule also breaks connections that rely on IPv4 options. If your shop or app runs in Docker containers, the rule will not protect it. That leaves rebooting into the fixed kernel on release day.

The Ubuntu Security Team believes that “security updates are the only appropriate mitigation”. On a server reachable from the internet, add the rule anyway.

What Ubuntu Pro and kernel live patching cost

Ubuntu Pro adds two things here: Livepatch, which applies kernel fixes without a reboot, and security fixes for older releases such as 20.04. Livepatch only applies fixes Canonical has already released, so it cannot deliver this fix any sooner. The latest Livepatch notice is from 7 October, before this flaw was disclosed.

On EC2 in us-east-1 (N. Virginia), Ubuntu Pro adds about $2.56 a month to a t3.medium instance’s bill, according to AWS pricing on 4 November 2026. Outside the cloud, Canonical charges $500 a year per server, but it gives Pro free on 5 machines for you or any business you own. EC2 also has Amazon Linux 2023, where AWS patches the kernel live at no additional cost once you turn it on.

A running EC2 instance has to be stopped to move to hourly-billed Pro. Amazon Linux 2023 is a different distribution, so moving to it means migrating the server.

Ubuntu 22.04 and 24.04 get this fix without Pro, so if your server can reboot at night, Pro gains you nothing here. It makes sense on a 20.04 server you cannot move quickly, or on one you cannot reboot right after every critical patch. You still reboot it, just at a time you choose.

What it means for a small team

• On Debian 12 and 13 and on Amazon Linux 2, update the system and reboot the server now. On Amazon Linux 2023, first switch the repository to the latest version: sudo dnf --releasever=latest upgrade, then reboot.
• On Ubuntu 22.04 and 24.04, book a night-time reboot window now. When the fix is released, update by hand, reboot and check uname -r. Until then, add Red Hat’s rule.
• Since May 2025 Ubuntu 20.04 has received security fixes only through Ubuntu Pro, and this fix will come the same way. Its standard 5.4 kernel has no test build yet; the HWE 5.15 kernels are in testing. Until then, add Red Hat’s rule and plan the upgrade to 22.04, which gets the fix without Pro.

If a hosting company manages the server, the kernel and reboot are its job, so ask when it will do them. If nobody tracks such reboots for you, my maintenance service covers security updates in an agreed window and critical patches within a few working days.

Once uname -r shows at least the tracker’s fixed version for your kernel line, such as 6.8.0-149 for generic 24.04, this flaw no longer affects that server.