CVE-2026-98432: All affected systems patched within hours

CVE-2026-98432 is a use-after-free flaw in the IPv4 TCP handshake path of the Linux kernel, affecting kernel versions 4.4 and later. A remote attacker without any credentials can trigger it by sending crafted TCP packets to a listening port, which can lead to a kernel crash, disclosure of kernel memory, or memory corruption. Researchers have already demonstrated unauthenticated remote code execution as root against hosts with a Multipath TCP listener. For an infrastructure provider like us, a critical kernel flaw means one thing: patch immediately.

When the vendor patches were released on Friday the 30th of October 2026, we did not wait. Our team started rolling out the fixes the very same evening, one system after another. There were no public reports of active exploitation at that point, but the disclosed exploit path made it clear that the window for action was short. At stepping stone AG, a critical kernel vulnerability in our infrastructure is always treated as an emergency, never as a routine update.

During the maintenance work, a brief issue in our network setup caused some of our services to be temporarily unreachable. We fixed it as soon as it became apparent, and full availability was restored shortly after. We have documented what went wrong so that it does not happen again.

This event reminded us why security sits at the center of everything we do. Speed and stability can sometimes compete with each other, but when a critical flaw like CVE-2026-98432 is on the table, there is no middle ground. We would do it exactly the same way again: patch first, report afterwards, and make sure our customers' data stays protected.