Ubuntu kernel CVE-2026-98432 risks RCE: patch and reboot now

I noticed Ubuntu added kernel notices on 11 Nov. 2026 for Azure CVM and the NVIDIA variants, so I put together the items to check. The main one is CVE-2026-98432, which poses a remote code execution risk over IPv4 TCP. OpenEXR and uutils have conditions that need separate checks.

The table is based on the Ubuntu notice index. You can also read the 10 Nov. kernel roundup and the previous NVIDIA roundup alongside it.

IPv4 TCP bug poses a remote code execution risk

CVE-2026-98432 is a use-after-free during TCP connection setup. Memory holding IP options is freed while another CPU is still using it to build a SYNACK. The patch waits until no other readers are accessing that data before freeing the memory.

Ubuntu assigns it Critical priority and CVSS 3.1 = 9.8, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This means it can be attacked over the network without system privileges or user interaction. The impact on data and system operation is high. This score does not indicate that attacks have already occurred.

CVE-2026-98239 is a use-after-free in the lan743x driver when a packet uses multiple buffers. Check whether the relevant hardware is in use. Another issue is CVE-2026-97981 in the Cortina Ethernet driver, which does not count bad frames against the receive processing budget. I list each CVE once, without counting it again across multiple USNs.

Fixed versions must match the release and flavor

This table shows the CVE-2026-98432 status from the Ubuntu tracker. Source package version numbers differ from the output of uname -r, so check the package name as well.

azure-fde is used for CVM. The Ubuntu notice index lists fix notices, but some branches in the tracker still show Vulnerable / work in progress. These two sources do not yet agree, so this table retains the tracker status. I could not open the detailed USN HTML pages. Check the fixed version in the notice against the package APT will install.

OpenEXR on machines that accept or convert EXR files

DSA-6618-1 covers 26 CVEs. Malformed image files could stop a service or cause reads and writes outside allocated memory. Debian trixie is fixed in 3.2.12-1~deb13u1. The runtime package is still named libopenexr-3-1-30.

The DSA lists CVE-2026-27622, CVE-2026-34379, CVE-2026-34380, CVE-2026-34543, CVE-2026-34544, CVE-2026-34588, CVE-2026-34589, CVE-2026-40244, CVE-2026-40250, CVE-2026-41142, CVE-2026-42216, CVE-2026-42217, CVE-2026-54920, CVE-2026-55059, CVE-2026-55373, CVE-2026-59183, CVE-2026-59184, CVE-2026-59186, CVE-2026-59189, CVE-2026-59981, CVE-2026-59982, CVE-2026-59983, CVE-2026-59984, CVE-2026-59985, CVE-2026-61555 and CVE-2026-68515.

According to upstream, CVE-2026-34589 occurs in the DWA decoder. A buffer offset calculation causes an integer overflow, followed by a write outside allocated memory. Upstream testing found that the program crashed. Upstream assigns CVSS 4.0 = 8.4 High, with the vector CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The vector specifies Local access and requires Active user interaction. This source does not confirm unauthenticated RCE.

Check whether the upload or thumbnail generation stage calls OpenEXR. Check workers and containers too. While waiting for patches, I recommend temporarily suspending EXR processing jobs. Filtering file extensions alone cannot replace the patch.

# สำหรับ Debian trixie ที่ติดตั้งแพ็กเกจนี้อยู่แล้ว
dpkg-query -W -f='${binary:Package}\t${Version}\t${db:Status-Status}\n' 'libopenexr*' openexr
sudo apt update
apt-cache policy libopenexr-3-1-30
# ตรวจว่า Candidate เป็น 3.2.12-1~deb13u1 หรือใหม่กว่าก่อนติดตั้ง
sudo apt install --only-upgrade libopenexr-3-1-30
# ถ้าติดตั้ง needrestart อยู่แล้ว ให้แสดงรายการก่อนเลือกเริ่มบริการใหม่
sudo needrestart -r l

Update any other installed OpenEXR packages too, then restart processes using the old library. needrestart -r l only lists them. The individual CVE page clearly distinguishes trixie version 3.1.13-2, which is still vulnerable, from trixie (security) version 3.2.12-1~deb13u1, which is fixed. This agrees with the DSA.

For uutils, check the commands and file permissions

USN-9041-1 concerns rust-coreutils, or uutils. Check it separately from GNU coreutils. Confirmed examples are:

• CVE-2026-93658: install may leave behind setuid/setgid files if changing ownership fails. Upstream testing found that privilege escalation was possible when root lacked CAP_CHOWN. The attacker must be able to access the leftover file, and the system must allow setuid use.
• CVE-2026-35341: mkfifo fails to create a FIFO but still changes the permissions of the existing file, potentially exposing confidential data.
• CVE-2026-35344: dd does not report errors when truncating a file, so it may report success even though the data is incorrect.
• CVE-2026-35363: rm does not recognize a path to the current directory that ends with a slash, so it may delete the contents despite safeguards.

Ubuntu's information still disagrees: USN-9041-1 in the CVE JSON lists the fixed version for 26.04 LTS as 0.10.0-1ubuntu2~26.04.1 in the security pocket and includes all four CVEs above. However, the 353xx CVEs still show Vulnerable. The notes also say this version is only in resolute-updates, while CVE-2026-93658 still shows Needs evaluation. I cite the fixed version from the USN and recommend checking the APT candidate before installing.

The upstream page for CVE-2026-93658 still lists Patched versions as None, while Ubuntu says versions before 0.10.0 are affected and provides a fixed package in the USN above.

dpkg-query -W -f='${binary:Package}\t${Version}\t${db:Status-Status}\n' rust-coreutils coreutils
apt-cache policy rust-coreutils
type -a install mkfifo dd rm
install --version
dpkg-query -L rust-coreutils
# เมื่อยืนยัน candidate ตามประกาศแล้ว
sudo apt install --only-upgrade rust-coreutils

Also check PATH, aliases and the binaries called by scripts. Patches do not restore existing file permissions or recover data that has already been damaged. Check permissions and test backups as well.

Update the kernel, then check the running version

Check the release, architecture and image with dpkg-query. Count only rows marked installed.

cat /etc/os-release
dpkg --print-architecture
uname -r
uname -v
dpkg-query -W -f='${binary:Package}\t${Version}\t${db:Status-Status}\n' 'linux-image*'
apt-mark showhold

1. Match the branch Check the release, architecture, flavor and metapackage
2. Prepare downtime Check boot recovery options and required modules
3. Install patches Read the update list before confirming
4. Reboot and check Compare the running kernel with the new image, then test services

sudo apt update
sudo apt -s upgrade
# อ่านรายการก่อน และตรวจว่า kernel metapackage ได้อัปเดตด้วย
sudo apt upgrade
if command -v dkms >/dev/null 2>&1; then dkms status; fi
# เมื่อโมดูลและรอบหยุดบริการพร้อมแล้ว
sudo reboot

Ubuntu says to reboot after installing the kernel. The article, updated on 9 Nov., says enabling proposed is no longer necessary, but the flavor still needs checking. After booting, run the same checks again, then compare uname -r and uname -v with the new package.

Check for unusual signs and prioritize the work

The sources I checked did not provide a set of IOCs for confirming an attack. Symptoms such as kernel Oops/panic, workers crashing after receiving images, or unexpected file permission changes can serve as clues, but they can also have other causes. Keep logs and the files that triggered the symptoms for further investigation.

# อ่าน log ประกอบการตรวจ ไม่ใช่ตัวตรวจ exploit
sudo journalctl -k -b --no-pager | grep -Ei 'oops|panic|use-after-free|general protection fault'
sudo journalctl -k -b -1 --no-pager
systemctl --failed

CVE-2026-98432, CVE-2026-98239, CVE-2026-34589 and CVE-2026-93658 are not yet in the 10 Nov. 2026 KEV edition, so that edition has no dateAdded or dueDate for any of the four entries. Absence from KEV does not mean attacks have not occurred. Ubuntu mentions an unpublished TCP exploit. That statement does not confirm it has been used in actual attacks.

If the work needs prioritizing, I recommend promptly patching and rebooting Ubuntu systems that accept external connections, as well as updating machines that accept EXR files from users. For uutils, start with jobs that run with elevated privileges and backup jobs.

Sources: Ubuntu Security Notices, Ubuntu TCP advisory, Debian DSA-6618-1, OpenEXR upstream, uutils upstream, CISA KEV and the sources linked in the text. Information checked through 11 Nov. 2026, using the 10 Nov. 2026 KEV edition. The kernel table uses CVE tracker statuses, while the fixed uutils version comes from the USN data in the CVE JSON. I'll come back and update this later.