CVE-2026-98432 Detection Toolkit

Tools for detecting exposure to CVE-2026-98432 — a Linux kernel IPv4 TCP use-after-free (CVSS 9.8) affecting kernels 4.4 through pre-fix stable branches.

Tools

File	Purpose	Requires
check-cve-2026-98432.sh	Local kernel version check — confirms patched/vulnerable	Shell access (SSH/console)
probe-mptcp.py	Remote MPTCP capability probe — detects the demonstrated exploit vector	Python 3.9+, Linux kernel ≥ 5.6 on the probing host
scan-and-probe.sh	Chains nmap port discovery into the MPTCP probe	nmap + above

Quick start

Local check (run on each server)

chmod +x check-cve-2026-98432.sh
./check-cve-2026-98432.sh

Exit codes: 0 patched, 1 vulnerable, 2 needs reboot or manual check.

Remote MPTCP probe (run from any Linux box with kernel ≥ 5.6)

Single host, known ports:

python3 probe-mptcp.py <HOST> <PORT> [PORT ...]
python3 probe-mptcp.py 192.168.1.1 22 443 5060

Single host, auto-discover all open TCP ports with nmap:

python3 probe-mptcp.py <HOST> $(nmap -Pn --open -p- <HOST> -oG - | grep -oP '\d+/open/tcp' | cut -d/ -f1 | tr '\n' ' ')

Replace both <HOST> with the target IP.

Multiple hosts:

chmod +x scan-and-probe.sh
./scan-and-probe.sh <HOST1> <HOST2> <HOST3>

What the tools check

check-cve-2026-98432.sh

1. Queries the vendor changelog for the CVE (authoritative on Debian/Ubuntu/RHEL).
2. Falls back to comparing uname -r against the first fixed version per stable branch.
3. Flags pending reboots (patched kernel installed but not booted).
4. Reports MPTCP state (net.mptcp.enabled and active MPTCP listeners).

probe-mptcp.py

Opens a standard MPTCP-requesting TCP connection and checks whether the server negotiated MPTCP or fell back to plain TCP.

• PLAIN-TCP — server did not negotiate MPTCP; demonstrated root-exploit vector absent.
• MPTCP-ACTIVE — server negotiated MPTCP; exposure vector present.
• CLOSED — port filtered or refused.

Safe: no IP options, no resend/race, no exploit trigger. It is a normal TCP handshake with the MPTCP capability flag.

Limitation: PLAIN-TCP does not mean patched. It means the demonstrated vector is closed. The underlying race exists in plain IPv4 TCP — only the kernel version confirms the fix.

Fixed kernel versions

Branch	First fixed
5.10.x	5.10.272
5.15.x	5.15.223
6.1.x	6.1.190
6.6.x	6.6.159
6.12.x	6.12.113
6.18.x	6.18.56
7.2.x	7.2.10
7.3+	Fixed at release

Immediate mitigation (if patching is not yet possible)

sysctl -w net.mptcp.enabled=0
echo 'net.mptcp.enabled=0' > /etc/sysctl.d/90-disable-mptcp.conf
sysctl --system

This disables MPTCP kernel-wide, closing the demonstrated root-exploit path. No reboot required; persists across reboots. Most services never use MPTCP, so functional impact is nil.

References

• The Hacker News — Linux Kernel TCP Flaw With 9.8 CVSS
• Debian tracker — CVE-2026-98432
• Kernel fix commit
• Anthropic research post

License

MIT