Linux TCP exploit: our response.
Researchers have demonstrated remote root access through a Linux TCP vulnerability, CVE-2026-98432. Intercube has already deployed mitigation across its entire fleet. Our engineers handle the host and network security behind your application as part of managed hosting.
- Author
- Intercube
- Published
- Reading time
- 4 min read
01
A network vulnerability below the application
On 27 October, Anthropic described a working exploit for CVE-2026-98432 against Linux servers with a multipath TCP listener. In its demonstration, a remote attacker could execute commands as root without credentials or user interaction.
The underlying issue is a race condition in the kernel’s IPv4 TCP connection handling. Memory can be freed while another part of the kernel still uses it. The upstream fix addresses that use-after-free. This is below WordPress, Magento, PHP or an application framework: updating application dependencies alone does not replace the affected host kernel.
The demonstrated configuration is important context, but the kernel advisory covers IPv4 TCP handling more broadly. Assess the installed kernel and exposed services together. The absence of a multipath TCP listener alone should not be used as evidence that an affected kernel is fixed.
02
Upstream fixes and Ubuntu packages are different
The CVE record was published on 15 October. By 29 October, Canonical’s tracker still listed affected Ubuntu 22.04, 24.04 and 26.04 kernel packages as vulnerable, with fixes in progress. The upstream Linux correction exists; a fixed package for the exact Ubuntu kernel flavour is a separate delivery step.
Operators need to identify the kernel actually running on each host, including cloud-specific or hardware-enablement variants. A package installed on disk and the kernel currently serving the application can be different versions. The update route needs to account for activation, any required restart and the application’s availability requirements.
For a hosting customer, the useful question is who owns that whole task: reviewing exposure, applying suitable controls, following the distribution release and confirming the running kernel after remediation. A server subscription still needs an engineering team to carry out that work.
03
Mitigation is in place across our fleet
Intercube has applied mitigation for CVE-2026-98432 across the entire fleet. That response is already in place. The mitigation addresses the immediate risk; replacing the vulnerable kernel with a corrected distribution build is the separate remediation step.
This is part of the infrastructure responsibility our customers place with us. Intercube engineers manage the operating system, runtime and supporting services, with the context to assess how a host-level security issue relates to the applications running on it. Your development team keeps ownership of application code and releases.
Our PHP2Shell response on 21 October put the released PHP security patch on every server within 20 minutes of availability. Kernel maintenance and runtime patching are both part of the engineering work behind our managed hosting service.
04
Choose hosting with engineers responsible for the host
When comparing hosting, ask for the status of the environment your application actually uses. A useful answer identifies the affected kernel, the response already applied and the team responsible for completing remediation. Where suspicious activity is present, preserve logs and investigate unexpected privileged processes, account changes and outbound connections alongside the vulnerability response.
With Intercube, those infrastructure questions go to engineers who operate the environment. We bring server configuration, managed runtime and service maintenance, monitoring and engineering support into the hosting relationship. The support SLA sets the agreed coverage and escalation route.
If your developers currently maintain the server as well as the application, we can plan a move to Intercube. Our engineers prepare the target environment, agree application checks with your team and coordinate the transfer and production cutover. Migration to Intercube managed hosting is included at no additional cost.
What matters for your hosting
- CVE-2026-98432 concerns the Linux kernel’s TCP handling, below the application.
- Anthropic demonstrated remote root access against a server with a multipath TCP listener.
- Check the exact Ubuntu kernel package and the kernel currently running.
- Intercube has already deployed mitigation across its entire fleet.
- Mitigation and installing a corrected kernel are separate stages of the response.
- Migration to Intercube managed hosting is included at no additional cost.