Linux TCP flaw: check the hosts behind your store

A critical Linux networking flaw deserves a check of the servers around your store: custom apps, middleware and self-managed storefront infrastructure. CVE-2026-98432 affects the kernel’s IPv4 TCP handling, so an application-only update is not a substitute for checking the host.

Red Hat rates it Critical and describes remotely triggered memory corruption or a crash. In a separate 27 October research disclosure, Anthropic reports a working proof of concept against a Linux server with a multipath TCP listener, allowing commands to run as root without credentials. That demonstrated configuration is important; it is not evidence that every exposed Linux service has already been compromised.

Check the distribution, not just the headline

On our 2 November check, Ubuntu’s tracker still listed the main kernel packages for 22.04, 24.04, 26.04 and 26.10 as vulnerable, with fixes in progress. Red Hat’s page listed RHEL 8, 9 and 10 as affected. These are time-sensitive vendor statuses, not a permanent compatibility table.

AWS’s bulletin says fixed Amazon Linux kernel packages are available and directs self-managed EC2 and Lightsail customers to update and reboot. It separately says Lambda workloads are not affected by this exposure and require no customer action. Managed services and self-managed instances should therefore not receive the same blanket instruction.

Give the hosting owner a concrete task

Our recommendation is to list the hosts behind your custom commerce services and assign an owner to each. Ask them to confirm the distribution advisory, the fixed package and the kernel actually running after maintenance. Check critical webhooks and integration jobs after any restart, and retain the result with the maintenance record.

Where a patch is unavailable, ask the provider for its current supported mitigation. AWS describes disabling multipath TCP as an interim reduction in exposure, not a complete fix. Avoid copying an arbitrary firewall command into production without checking how it affects legitimate traffic.

This is separate from the runtime work in our Node.js patch guide. Keep host, runtime and application checks separate so that completing one does not mistakenly close the others.