Mutipath TCP: Use and Detection, (Mon, Nov 2nd)

Monday, November 2, 2026 at 02:52 PM UTC·Source: SANS ISC

Updated: Monday, November 2, 2026 at 03:01 PM UTC

Executive Summary

Last week, an often-ignored&&#x23;x26;&#x23;xc2;&&#x23;x26;&#x23;xa0;TCP option, introduced in 2020, made the news due to a new vulnerability in Linux&&#x23;x26;&#x23;39;s implementation (RFC&&#x23;x26;&#x23;xc2;&&#x23;x26;&#x23;xa0;8684, &&#x23;x26;&#x23;xc2;&&#x23;x26&#x3b

Analysis

Indicators of Compromise (1)

CVE (1)

CVE-2026-98432

NVD MITRE CVE

Source Attribution

Originally published by SANS ISC on Nov 2, 2026.

Related Threats

CRITICALVulnerability

Attackers are scanning the internet for Linux servers vulnerable to CVE-2026-98432 (CVSS 9.8), a critical TCP race-condition flaw that could allow remote root access. Over 2.1 million servers reportedly exposed. Ubuntu still has no patch.

[object Object]

CVE-2026-98432

Nov 4, 2026r/cybersecurity

MEDIUMVulnerability

Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing

Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can

CVE-2026-98432

Nov 3, 2026The Hacker News

CRITICALAi

Backporting security fixes at scale with Codex

<p>Stable Linux releases lack existing security fixes because backporting them is time-consuming and often thankless work. We’re using Codex to reduce the backporting process time from days to hours per fix, empowering human patch reviewers to rapidly submit fixes for critical software like Ubuntu Long Term Support, Fedora, and the Linux kernel. By October 29, our project helped deliver fixes for

CVE-2026-98432

Nov 2, 2026Trail of Bits