Linux Kernel CVE-2026-98432 + 6 More

A critical flaw in the Linux kernel's IPv4 TCP handling (CVE-2026-98432, CVSS 9.8) can be reached remotely without authentication. If you run Linux servers, start by listing the affected hosts. As of Nov 1, fixed kernels for Red Hat and Ubuntu are not yet published. Debian has fixed packages, and Red Hat has published a firewall rule as an interim measure. This digest also covers pgAdmin (CVE-2026-116241, CVSS 9.9), LXD (CVE-2026-112816, CVSS 10.0) and four WordPress plugins. None of the seven CVEs is in CISA's Known Exploited Vulnerabilities (KEV) catalog, so confirmed exploitation is zero.

Based on CVE Program records, Red Hat, Ubuntu and Debian pages, the CISA KEV catalog (version of Oct 30, 2026), the pgAdmin release notes, Canonical's advisory and WordPress.org plugin data as of Nov 1, 2026. NVD pages could not be retrieved, so CVSS values come from the CNA recorded in each CVE record, with the scorer noted.

While the kernel accepts a TCP connection, IPv4 options attached to the connection request can be freed while another code path is still reading them (use-after-free). The fix delays the free until after an RCU grace period. Red Hat says an unauthenticated remote attacker could cause kernel memory corruption or an immediate crash, and that remote code execution is possible, but that exploitation requires precise timing of network requests.

- Severity: CVSS v3.1 9.8 (Critical), scored by the Linux kernel CNA. Red Hat shows the same value as preliminary. Ubuntu priority is High
- Affected (CVE record): kernels from 4.4 before the fixed versions below
- Upstream fixed versions: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3
- Distributions (checked Nov 1): Debian fixed (bookworm 6.1.190-1, trixie 6.12.113-1). Red Hat lists RHEL 8, 9, 10 and OpenShift as affected with no fixed kernel yet. Ubuntu lists 22.04, 24.04 and 26.04 among others as vulnerable, with fixes in progress
- Exploitation: Red Hat's bulletin does not state any; not in KEV (Oct 30 catalog)
- Interim measure: Red Hat published an nftables rule that drops IPv4 TCP packets carrying IP options. It says this reduces exposure but is not a substitute for patching and may disrupt workloads, so test it first

How to check: run uname -r, then watch your distribution's advisory (Red Hat RHSB-2026-016, the Ubuntu CVE page). Cloud and container hosts running Linux can also be affected, so ask providers about their status. Official: Red Hat RHSB-2026-016, Ubuntu, Debian. A previous kernel case is covered in Copy Fail mitigation.

pgAdmin 4 is a PostgreSQL management tool. Per its release notes, a query written to slip past the Import/Export check can run an arbitrary command on the pgAdmin host. It is an incomplete fix of CVE-2026-17566, involving a backslash in a double-quoted identifier when standard_conforming_strings is off.

- Severity: CVSS v3.1 9.9 and v4.0 9.4 (Critical), scored by the PostgreSQL CNA. Low privileges are required (PR:L)
- Affected: pgAdmin 4 before 9.19
- Fixed: 9.19 (released Oct 29, 2026)
- Workaround: none stated. Exploitation: none stated; not in KEV

Prioritize multi-user server-mode deployments, since anyone who can log in is a possible entry point. Official: pgAdmin 9.19 release notes.

LXD runs containers and virtual machines on Linux. Its HTTPS listener fails to validate certificates properly, so an attacker holding a trusted client's public certificate can authenticate as that client by placing it as an intermediate certificate. Canonical says this can reach host root depending on the victim's privileges. In MicroCloud, an attacker able to intercept a joining member's public certificate can impersonate that member.

- Severity: CVSS v4.0 10.0 (Critical), scored by the Canonical CNA
- Affected (CVE record): LXD 4.0.14, 5.0.10, 5.21.8 and 6.9.0 up to before 4.0.15, 5.0.11, 5.21.9 and 6.10.1 respectively
- Fixed: LXD 6.10.1, 5.21.9, 5.0.11, 4.0.15; MicroCloud 3.4.1, 2.1.5. Rollout to stable snap channels is progressive
- Update: sudo snap refresh lxd (sudo snap refresh microcloud)
- Exploitation: not stated; not in KEV

Official: Canonical advisory.

- SimpleForm (CVE-2026-118235): arbitrary file upload via trailing-dot filenames. 3.10.2 and below. The CVE record names no fixed version; the WordPress.org latest is 3.11.0
- FunnelKit Automations (CVE-2026-39738): PHP object injection. 3.8.6.1 and below; fixed in 3.8.6.2 (Patchstack)
- Project Manager (CVE-2026-116512): dynamic PHP function call before the authorization check. 4.1.1 and below. No fixed version named in the record; latest is 4.1.2
- PDF Invoice for WooCommerce (CVE-2026-109220): PHP object injection through the checkout customer note. 7.1.1 and below. No fixed version named; latest is 7.2.0

Check the plugin list in the WordPress admin, update, and delete unused plugins. For the three plugins with no stated fixed version, confirm on the Wordfence page that the updated version is out of the affected range. See also WordPress maintenance risk and wp2shell.

- Ask your IT contact or vendor whether you run Linux servers, pgAdmin, LXD or the four WordPress plugins
- For Red Hat or Ubuntu hosts, decide who updates and reboots when the fixed kernel appears
- Have the vendor test the interim firewall rule in a non-production environment before using it
- Update pgAdmin to 9.19 or later and LXD to a fixed version
- Update or delete the WordPress plugins listed above
- Record the date and owner of each action

- Red Hat RHSB-2026-016
- Red Hat CVE-2026-98432
- Ubuntu CVE-2026-98432
- Debian Security Tracker
- CVE Program CVE-2026-98432
- CVE Program CVE-2026-116241
- pgAdmin 9.19 release notes
- CVE Program CVE-2026-112816
- Canonical advisory
- Wordfence SimpleForm
- Wordfence Project Manager
- Wordfence PDF Invoice
- CVE Program CVE-2026-39738
- CISA KEV catalog