Search — “CVE-2026-98432”

Veeam warned that Software Appliance VMs (version 13.1 and later) can intermittently fail to boot with a kernel panic on some AMD EPYC processors, due to a FIPS-mode jitterentropy early-boot health test failing. Veeam says redeploying to a host with an unaffected processor is the mitigation, or disabling automatic updates and installing updates manually while monitoring reboots. Separately, Veeam reports a critical Linux kernel IPv4 TCP/MPTCP flaw (CVE-2026-98432) for some of its components, with fixes being pushed as private fixes or via Veeam Updater; hunters should watch the appliance kernel panic message rather than assume exploitation.

Cisco updated its advisory for CVE-2026-111497, an out-of-bounds write in Google's Brotli library described as exploited, now affecting 19 Cisco products with more under investigation, and also says it has fixed CVE-2026-76506 in UCS Central. WatchGuard published advisories including critical AuthPoint Authentication Gateway authentication flaws, while Dimension remains unpatched. SonicWall says it will not fix CVE-2026-109593 (unauthenticated file read) and CVE-2026-109594 (SQL injection) in end-of-life GMS. The source does not describe any huntable attacker behavior or indicators for these flaws.

A use-after-free in the Linux kernel's IPv4 TCP code, tracked as CVE-2026-98432, can be triggered remotely and unauthenticated by SYN requests carrying IPv4 Record Route or Timestamp options to a listening TCP port, potentially leading to RCE. Red Hat shipped fixed kernels for RHEL 8, 9 and 10 on November 1 and published an nftables interim mitigation, while Ubuntu fixes remain in the opt-in -proposed pocket. The source states no vendor, CERT, or kernel CVE team has reported attacks, and a proof-only GitHub crash PoC exists that does not implement code execution. Hunters should watch for inbound IPv4 TCP SYNs with IP options to listening ports and check kernel versions against the fixed builds.

SANS ISC published a diary on Multipath TCP (MPTCP, RFC 8684) use and detection following disclosure of CVE-2026-98432 in the Linux kernel's MPTCP implementation. The diary explains the TCP option 30 structure and subtypes, and describes detection with tshark's mptcp filter, tcpdump header-length matching, Suricata tcp.hdr option bytes, and a Zeek tcp_option script. It does not describe exploitation or any observed attack activity.

Anthropic researchers reported a remote root exploit for a use-after-free race in the Linux kernel IPv4 TCP code (CVE-2026-98432), with the CNA scoring it 9.8 and Red Hat scoring it 5.9. The sources say RCE was demonstrated on servers with an MPTCP listener, while the flaw also affects ordinary TCP, and Go 1.24+ enables MPTCP listeners by default on Linux. Ubuntu, RHEL, and Rocky Linux were still vulnerable or awaiting fixes at publication, and the sources report no confirmed in-the-wild exploitation; hunters should inventory kernel versions and MPTCP listeners.

A race condition in the Linux kernel's IPv4 TCP connection setup (use-after-free, introduced in Linux 4.4) is tracked as CVE-2026-98432; the kernel CVE team scores it 9.8 while Red Hat scores it 5.9 or 8.1 depending on the file. Anthropic said on October 27 that its AI model wrote a working exploit that lets a remote unauthenticated attacker run commands as root on servers with an MPTCP listener, though the sources state no attacks using the flaw have been observed. Ubuntu and RHEL had no released fix as of October 29-30, so defenders should check distribution fix status and upgrade to patched kernels where available.

Anthropic's Frontier Red Team says an unreleased internal model found flaws and chained them into proof-of-concept exploits in lab conditions, with no real-world attacks seen and all reported flaws reported to vendors first. The Chrome chain combines four flaws (V8, sandbox escape, CacheStorage race, FedCM use-after-free) and was fixed in Chrome 156; the Safari chain was fixed in iOS/iPadOS 26.5.2; the Windows DoS and Linux multipath TCP root chain are tied to CVE-2026-33096 and CVE-2026-98432, though the public CVE records do not clearly match Anthropic's descriptions. Hunters have no in-the-wild behaviors to detect; the actionable item is verifying patch levels.