- CloudLinux 7h and 8: 4.18.0-553.180.1.lve.1, in staged rollout to production. To install it now: yum update cloudlinux-release yum update 'kernel*' --enablerepo=cloudlinux-rollout-3-bypass reboot
- CloudLinux 9: kernel-5.14.0-687.61.2.el9_8 and CloudLinux 10: kernel-6.12.0-211.69.2.el10_2, in the AlmaLinux testing repository. Red Hat hasn't released its fix yet. Steps to install from AlmaLinux testing are in the blog post.
- CloudLinux 8 LTS and 9 LTS: kernel-lts-5.14.0-284.1101.el8.tuxcare.11.els19 and kernel-lts-5.14.0-284.1101.el9.tuxcare.11.els19, in staged rollout. A regular kernel update installs them once the rollout reaches the server.
A reboot is needed to run the fixed kernel. The KernelCare livepatch for CloudLinux 7h, 8, 9 and 10 is still in preparation. CloudLinux for Ubuntu 22.04 is waiting on Canonical's fix.
CVE-2026-98432 (CVSS 9.8, Critical per Red Hat) is a use-after-free flaw in the Linux kernel’s IPv4 TCP code that a remote attacker can reach without an account on the server. Exploiting it means winning a timing race inside the kernel, which is hard to do. Anthropic, which reported the flaw, says its AI model built an exploit that gives remote root on servers with a Multipath TCP listener. Our kernel team couldn’t reproduce that claim. The exploit isn’t public, and no exploitation in the wild has been reported.
Affected: CloudLinux 7h, 8, 8 LTS, 9, 9 LTS and 10, and CloudLinux for Ubuntu 22.04. CloudLinux 7 isn’t affected. → Affected CloudLinux versions Multipath TCP: the claimed exploit needs it, and it’s off by default on CloudLinux 8, 9 and 10. The bug itself is in ordinary TCP, so those servers still need the fix. → What the claimed exploit needs Mitigation: none. → Is there a mitigation? Fix status: → Update instructions CloudLinux 7h and 8 kernel: in preparation. AlmaLinux kernel (CloudLinux 9, 10): no fixed kernel yet. Red Hat hasn’t released its fix. LTS kernels (CloudLinux 8 LTS, 9 LTS): fixed kernel in staged rollout. KernelCare livepatch: in preparation for CloudLinux 7h, 8, 9 and 10. CloudLinux for Ubuntu 22.04: Canonical hasn’t released its fix yet.
We are aware of CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP code, and we have confirmed that CloudLinux OS 8, 9, and 10 kernels are affected.
Severity ratings differ between vendors: Red Hat currently rates it Moderate, while other vendors rate it higher. The issue requires specific non-default configuration to be triggered, and exploitation is considered complex. The upstream Red Hat fix has not been released yet.
A kernel update and a KernelCare livepatch are not available yet. We are tracking the upstream fix and will release updated kernels and live patches for CloudLinux OS 8, 9, and 10 once it is available.
We will post updates here as they become available.
Posted Oct 29, 2026 - 18:30 UTC
This incident affects: CloudLinux OS Components (CloudLinux Kernel).