# \[SECURITY\] Linux Kernel CVE-2026-98432

**URL:** <https://forum.pritunl.com/t/security-linux-kernel-cve-2026-98432/3874>\
**Category:** Pritunl\
**Created:** [October 30, 2026, 3:37am UTC](https://forum.pritunl.com/t/security-linux-kernel-cve-2026-98432/3874 "2026-10-30T03:37:30Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [October 30, 2026, 3:37am UTC](https://forum.pritunl.com/t/security-linux-kernel-cve-2026-98432/3874/1 "2026-10-30T03:37:31Z")

</div>

The TCP packet processing vulnerability CVE-2026-98432 in the Linux kernel published on Oct 15 was initially believed to only have the potential to crash a server. More information has since become available demonstrating that it could allow remote code execution.

Due to the initial understanding of a limited impact most Linux distributions have not yet patched the vulnerability. Currently only Oracle Linux UEK, Debian and Amazon Linux 2023 is known to have it patched. All other distributions are working on providing a patch. All network accessible Linux servers including Pritunl servers should be updated as soon as possible.

Oracle Linux currently has the UEK kernel patched. The UEK kernel is the default for Oracle Linux installations but the RHEL based kernel can optionally be configured which will not have the patch. Run “uname -a” to verify the “uek” is included in the kernel version. The patched kernel versions are:

UEK R6 (Oracle Linux 8/9): 5.4.17-2136.360.3.1  
UEK R7 (Oracle Linux 9/10): 5.15.0-325.221.6.4  
UEK R8 (Oracle Linux 10): 6.12.0-207.111.5.4

Ubuntu users should monitor [**Ubuntu CVE-2026-98432**](https://ubuntu.com/security/CVE-2026-98432#status) for their specific kernel package, install the patch when it becomes available, and then reboot the server.

RHEL based distributions including AlmaLinux and Rocky Linux can use the command “sudo dnf --refresh updateinfo info --all --cves CVE-2026-98432” to monitor for an updated kernel. Once available update the kernel and reboot the server.

A likely mitigation for CVE-2026-98432 is to add an iptables rule to drop all IPv4 TCP traffic that carries IP options. This can safely be done on most Linux servers without impacting legitimate traffic. It has been tested on Pritunl VPN servers with no observed impact.

```bash
sudo iptables -t raw -I PREROUTING 1 -p tcp -m u32 --u32 '0>>24&0xF=6:15' -j DROP

```