CloudLinux published a hosting-focused response to CVE-2026-98432 on October 30, 2026, and began staged kernel rollouts for several product lines. The Linux kernel flaw is reachable through IPv4 TCP without an account, but CloudLinux says it has not reproduced a separate claim that the bug can be turned into remote root access.
Editorial status: Published; patch rollout is developing and claims remain attributed to cited sources. Upstream advisory date: October 15, 2026. CloudLinux publication/update date: October 30, 2026. Source checked: November 2, 2026. Updated: November 2, 2026. Verification: Corroborated.
What Happened
The Linux kernel CVE team describes a use-after-free in IPv4 TCP option handling and assigns a CVSS 3.1 score of 9.8. The issue was introduced in Linux 4.4 and has fixes in supported upstream branches.
CloudLinux says affected products include CloudLinux 7h, 8, 8 LTS, 9, 9 LTS and 10, plus CloudLinux for Ubuntu 22.04. CloudLinux 7 uses an older kernel and is not affected. As of the vendor’s October 30 update, fixed kernels for CloudLinux 7h, 8 and the LTS lines were in staged rollout; AlmaLinux fixes for CloudLinux 9 and 10 were available in testing; KernelCare livepatches were still in preparation; and Canonical had not yet released the Ubuntu 22.04 fix.
Why It Matters
Hosting servers expose IPv4 TCP services for websites, mail and administration, so the vulnerable code is broadly reachable. Exploitation is not the same as reachability: CloudLinux says triggering the race is difficult, the described remote-root technique needs a Multipath TCP listener, and MPTCP is disabled by default on CloudLinux 8, 9 and 10.
The vendor also says disabling MPTCP is not a complete mitigation because ordinary TCP still reaches the flawed code. Administrators need the fixed kernel or an applicable livepatch.
What the Company Says
CloudLinux says its kernel team could not reproduce Anthropic’s reported remote-root result, the exploit is not public and it had no reports of exploitation in the wild as of October 30. The company recommends installing the appropriate fixed kernel and rebooting, or using a KernelCare livepatch once available for the relevant stream.
HostingReviewLab Context
This is primarily a server-operator issue. Shared-hosting customers usually cannot inspect or replace the host kernel themselves, while unmanaged VPS and dedicated-server users may own that work. Our hosting security responsibility guide can help identify who should confirm the running kernel and reboot state.
What We Haven't Independently Verified
HostingReviewLab has not reproduced the memory flaw, reviewed private exploit material, confirmed the claimed remote-root path or verified a provider’s installed kernel fleet. Patch availability was still uneven across CloudLinux streams at the source-check time and may change after publication.
What Customers Should Know
- CloudLinux administrators should identify the exact OS product, kernel stream and running kernel before applying vendor instructions.
- Installing a kernel package is not enough if the server has not rebooted into it; verify the running version afterward.
- Use CloudLinux’s current advisory rather than copying commands from a secondary report because staged-rollout and repository status can change.
- Shared-hosting customers can ask the provider whether affected CloudLinux kernels were present and whether the fix is active, not merely downloaded.
- Separate the confirmed use-after-free and available fixes from the unverified remote-root exploit claim.
Sources
- CloudLinux CVE-2026-98432 status and update instructions — published and last updated October 30, 2026; checked November 2, 2026.
- Linux kernel CVE team advisory — upstream advisory dated October 15, 2026; checked November 2, 2026.