Back to overview
Degraded

Critical Linux Kernel Vulnerability - CVE-2026-98432 (CVSS 9.8)

Oct 29, 2026 at 3:31pm UTC
Affected services
General Announcements

Updated
Nov 3, 2026 at 8:02am UTC

We have rolled out a kernel-level mitigation (net.mptcp.enabled=0) across all servers to protect against CVE-2026-98432.

  • Mitigation Scope: Applied automatically across all servers running Ubuntu 16.04 LTS and newer.
  • Customer Action: No action is required, as this mitigation has already been applied automatically. However, if you wish to run or verify updates manually, you can still do so through the Patch Manager.
  • Official Kernel Patches: Ubuntu's upcoming official kernel fixes will only cover Ubuntu 22.04 LTS and newer. For servers running older releases (Ubuntu 16.04, 18.04, and 20.04), this applied mitigation serves as the primary ongoing protection.
  • Recommendation: We strongly recommend upgrading your OS to Ubuntu 22.04 LTS or newer to ensure your server receives official security patch updates moving forward.

Created
Oct 29, 2026 at 3:31pm UTC

We are monitoring CVE-2026-98432, a critical Linux kernel vulnerability with a CVSS score of 9.8 (Critical).

As per the latest Ubuntu Security Advisory, Ubuntu releases from 16.04 LTS (Xenial) onwards are listed as vulnerable.

Security fixes are currently marked as Work in Progress (WIP) for Ubuntu 22.04 LTS and newer releases, while Ubuntu 16.04 LTS, 18.04 LTS, and 20.04 LTS remain listed as vulnerable.

Recommended Precautions

While awaiting official Ubuntu security updates, we recommend:

  1. Create a full server snapshot at your cloud provider level, using your cloud provider's snapshot functionality. This provides a recovery point to restore your server to its previous state if issues occur after applying system updates.

  2. Enable automatic security updates through Ubuntu Unattended Upgrades to receive official security patches when available. This can be configured through the Server Settings page in your RunCloud dashboard.

  3. Maintain up-to-date backups of your web applications, databases, and other critical server data, separately from the server snapshot.

  4. Apply official kernel security updates once available. A server reboot may be required for the updated kernel to take effect.

Further Updates

RunCloud will continue to track Ubuntu's security advisories and the availability of official patches. We will provide further updates as the situation progresses.

Reference: https://ubuntu.com/security/CVE-2026-98432