Status on November 2, 2026: the Artica protections described on this page are available in Artica Service Pack 10 Hotfix 20261102-15.
Debian has published fixed kernels for Debian 12 and Debian 13.
Debian 10 only gets a fixed kernel through Freexian Extended LTS.
CVE-2026-98432 is a use-after-free flaw in the TCP/IPv4 stack of the Linux kernel.
It sits in the code that sets up a new TCP connection.
A remote attacker needs no account.
The attacker only needs to reach a listening TCP port of the server.
The flaw is only triggered by a TCP connection request (SYN) that carries IPv4 header options, such as Record Route or Timestamp.
A SYN without IP options cannot trigger it.
Legitimate traffic almost never carries IPv4 options.
The most likely result is a kernel crash, so the server goes down.
Some reports also mention a working privilege escalation against MPTCP listeners.
That exploit has not been published.
No attack in the wild has been reported so far.
Vendors rate the flaw differently: 9.8 for the kernel CVE team, 7.0 for AWS, 5.9 for Red Hat.
Artica appliances run the Debian Linux kernel.
They stay exposed until they run a fixed kernel.
The flaw is in the kernel, so no Artica component has to be patched for it.
| Debian version | Vulnerable kernel | Fixed kernel |
|---|---|---|
| Debian 13 (Trixie) | 6.12 before 6.12.113 | 6.12.113-1 (DSA-6568-1) |
| Debian 12 (Bookworm) | 6.1 before 6.1.190 | 6.1.190-1 (DLA-4841-1), or 6.12.113-1~deb12u1 from backports (DLA-4850-1) |
| Debian 10 (Buster) | 4.19, all versions | No fix for 4.19. Freexian Extended LTS publishes the 6.1 kernel linux-image-6.1-amd64 6.1.190-1~deb10u1 (ELA-1850-1) |
Any service that listens on TCP over IPv4 can be the entry point.
On an Artica appliance, that covers the proxy ports, the reverse proxy sites, the SMTP relay, the Web Console and the Artica REST API.
Appliances that publish services on the Internet are the most exposed.
Patch reverse proxies and SMTP relays first.
IPv6 connections do not trigger the flaw.
From Service Pack 10 Hotfix 20261102-15, the notification bell of the Web Console shows CVE-2026-98432 with the message Please update the Linux kernel.
The message stays until the server runs a fixed kernel.
Artica checks the kernel that is running now, not the kernel package that is installed.
A fixed kernel only counts after a reboot.
From a shell, read the version of the running kernel:
cat /proc/versionCompare the version written after the word Debian with the table.
On Debian 12, uname -r shows a package name such as 6.1.0-37-amd64.
That name does not give the kernel version.
Step 1: install the hotfix
Install Artica Service Pack 10 Hotfix 20261102-15.
It brings the bell notification, the firewall filter described below and a fix of the console kernel update.
Step 2: block the trigger with the firewall
The Artica firewall has an option named Suspicious Header Filter.
It drops IPv4 packets that carry header options before they reach the kernel TCP stack.
This removes the trigger of CVE-2026-98432 while you wait for the kernel update.
The option was off by default.
After the hotfix, Artica enables it once, on every interface handled by the firewall and in the default settings.
The change appears in the logs and in the firewall history.
If you turn the option off afterwards, Artica keeps your choice and does not turn it on again.
To check or change it:
Your Firewall > Parameters.Suspicious Header Filter and save.The hotfix also changes how the filter works:
u32 match of the standard Debian kernel.FIREHOL:IPV4OPTS: in /var/log/firewall.log, at most one line per second.To check that the filter is in place:
iptables -S INPUT | grep IPV4OPTS.DROP
iptables -nvL IPV4OPTSThe firewall filter blocks the trigger.
The kernel stays vulnerable until it is replaced.
On Debian 12 and Debian 13:
The hotfix also repairs the console kernel update.
Before, it stopped apt after 60 seconds.
On a small appliance, that can happen in the middle of the installation.
It now waits up to 15 minutes.
It also reported a success when another kernel installation was already running.
Debian 10 runs kernel 4.19.
Debian will never fix CVE-2026-98432 in kernel 4.19.
The Kernel update of the console installs the latest 4.19 kernel, so it cannot fix the flaw.
On Debian 10 the More information button of the notification opens this page instead.
The only fixed kernel for Debian 10 is the 6.1 kernel of Freexian Extended LTS: linux-image-6.1-amd64, version 6.1.190-1~deb10u1.
It needs the Freexian Extended LTS repository.
The PHP2Shell fix for Debian 10 adds this repository.
apt-get update
apt-get install linux-image-6.1-amd64Moving a Debian 10 appliance from 4.19 to 6.1 is a big change.
Kernel modules built by Artica for 4.19 do not load on 6.1.
This includes xtables-addons (GeoIP and the original header filter), nDPI and the NFQueue packet filter.
Test the new kernel on one appliance first, and keep the 4.19 kernel installed to boot it again if needed.
The u32 filter keeps working on 6.1.
The best option for Debian 10 is to move to Debian 12 or Debian 13.
Until then, keep the Suspicious Header Filter enabled.
u32 mode, the filter checks TCP SYN packets only.The reported privilege escalation targets MPTCP listeners.
Artica services written accept MPTCP connections, because recent versions enable it by default.
The firewall filter blocks the trigger for MPTCP connections too.
To reduce the exposure further on a server that cannot be updated yet, you can disable MPTCP:
echo "net.mptcp.enabled = 0" > /etc/sysctl.d/90-mptcp.conf
sysctl -p /etc/sysctl.d/90-mptcp.confThe file keeps the setting after a reboot.
Clients fall back to plain TCP.
The setting only applies to services started after the change.
Restart the Artica services, or reboot, for it to take effect.
Debian 10 is not concerned: kernel 4.19 has no MPTCP.