On 15 October 2026 a critical vulnerability in the Linux kernel was published (CVE-2026-98432, CVSS 9.8). It is a flaw in how the kernel sets up IPv4 TCP connections and can allow a remote attacker to run code as root on a server, without logging in. It affects Linux kernels from version 4.4 onward on any server that accepts IPv4 TCP connections.
Status at MMITech
- Our entire infrastructure, including the Plesk web hosting servers, has been updated and patched.
- Since the day the vulnerability was announced, our network drops all incoming IPv4 TCP packets that contain IP options. This reduces the risk while you update your servers, but it does not replace a kernel update. Normal traffic is not affected.
- VPS hosting customers with a maintenance/managed contract and web hosting customers do not need to take any action.
Unmanaged VPS and dedicated server customers
The software on these servers is maintained by you, so we cannot update it for you. Please update the kernel and reboot as soon as possible. A new kernel only takes effect after a reboot.
How to update:
- Ubuntu: Ubuntu has not yet published the fix in its regular updates. The fixed kernel is available in the proposed repository. Enable it and install the fixed kernel with:
sudo add-apt-repository --component main --pocket proposed http://archive.ubuntu.com/ubuntu && sudo apt update && sudo apt -y dist-upgrade && sudo apt -y autoremove && sudo apt autoclean && dpkg-query -W -f '${source:Package}\t${binary:Package}\n' | awk '$1 ~ "^linux-meta" { print $2 }' | xargs sudo apt install -t $(. /etc/os-release && echo $VERSION_CODENAME)-proposed --only-upgrade -y && sudo reboot - Debian:
sudo apt update && sudo apt full-upgrade -y && sudo reboot - AlmaLinux / Rocky Linux / RHEL / CentOS Stream :
sudo dnf upgrade --refresh -y && sudo reboot
How to check: after the reboot, run uname -r and compare the running kernel with the fixed version listed by your distribution.
If you cannot update today: disable Multipath TCP if you do not use it with sudo sysctl -w net.mptcp.enabled=0, and drop IPv4 TCP packets with IP options on the server itself:echo 'table inet cve_2026_98432 { chain input { type filter hook input priority -310; policy accept; ip protocol tcp ip hdrlength > 5 counter drop; } }' | sudo nft -f -
This only reduces the risk. Updating the kernel is the only real fix.
Full advisory: ubuntu.com
If you need help, please open a support ticket.
