---
title: "Linux kernel IPv4 TCP vulnerability: CVE-2026-98432"
slug: "linux-kernel-ipv4-tcp-vulnerability-cve-2026-98432"
updated: 2026-11-09T13:10:31Z
published: 2026-11-09T13:10:31Z
canonical: "kb.ctera.com/linux-kernel-ipv4-tcp-vulnerability-cve-2026-98432"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://kb.ctera.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Linux kernel IPv4 TCP vulnerability: CVE-2026-98432

## CTERA Security Advisory CTERA-SA-2026-06-11

## Vulnerability Description

A race condition in how the Linux kernel sets up IPv4 TCP connections could let a remote, unauthenticated attacker corrupt kernel memory and possibly run code. CTERA Edge Filer and CTERA Portal both run affected Linux kernels.

### Vulnerability Details

Publication Date: Nov 8 2026

CVSS (Common Vulnerability Scoring System) 3.1 score of 9.8 QVSS (Qualys Vulnerability Scoring System) score of 7.2

## Affected CTERA Products

**CTERA Edge Filers**: 7.11.x: All versions before, and including, 7.11.5100.39 7.12.x: All versions before, and including, 7.12.5400.29 7.13.x: All versions before, and including, 7.13.6000.27

**CTERA Portal**: All versions. Fixed versions are expected is next few days.

### Analysis

This vulnerability is considered critical, as portals edge filers running affected, unpatched versions may remain exposed to remote exploitation, putting your organization's infrastructure, data, and business continuity at significant risk.

There are reports of suspected scanning since November 2, 2026. As of this advisory, **no public exploit has been confirmed**, the issue is not on the *CISA Known Exploited Vulnerabilities* list, and CTERA does not know of any exploitation against CTERA customers.

### Workaround

Until the update is installed, CTERA recommends:

1. Limit network access to portal servers so that only trusted networks and the required edge filer and client addresses can reach them.
2. Where possible, put portal behind a load balancer or reverse proxy that terminates TCP connections, so internet traffic doesn’t reach the portal kernel directly.
3. Watch for unexpected portal server reboots or kernel crashes, and report any to CTERA Support.

### Permanent Solution

**CTERA Edge Filers**: 7.11.x: All versions from 7.11.5100.40 and later 7.12.x: All versions from 7.12.5400.39 and later 7.13.x: All versions from 7.13.6000.29 and later

Customers who have **not** upgraded to one of these versions, or a higher version, are advised to schedule a short maintenance window for installing this patch version on their edge filers.

**CTERA Portal**: All versions. Fixed versions are expected is next few days.

**Note**

**CTERA-hosted (SaaS) portals**: CTERA will apply the update to hosted environments. No customer action is needed.

## Related Articles

[Vulnerability Remediation](/v1/docs/what-is-cteras-vulnerability-remediation)