Your Artifactory is fine. Your Linux kernel hosting it might not be.

What it is

CVE-2026-98432 is a race-condition use-after-free in the Linux kernel code that sets up new IPv4 TCP connections. The bug dates to Linux 4.4. The Linux kernel CVE team published it on 15 October 2026. Upstream fixed it on 5 October, after mainline patching on 17 September. JFrog's post is a host-patching advisory for self-managed JFrog customers: JFrog products themselves are not affected, and JFrog Cloud customers are not affected.

Preconditions / Affected

• The kernel team scores it 9.8. Red Hat, Oracle, SUSE and Amazon score it between 5.9 and 8.1.
• Anthropic's exploit needed a multipath TCP (MPTCP) listener. A remote attacker with no credentials got a root shell. Leaking a kernel address took 48 minutes, and command execution took five more. A lost race only kills that one connection, so the attacker can retry.
• Go programs request MPTCP by default on listening sockets since Go 1.24. JFrog notes that its deployments include several Go services on versions later than 1.24. The Go Security Team says the bug is not specific to MPTCP.
• As of 30 October, neither Ubuntu nor RHEL had a fixed kernel. Ubuntu 22.04 through 26.10 are marked work in progress, and older Ubuntu releases are vulnerable. RHEL 8, 9 and 10 are affected, with no date. Debian, Oracle Linux, SUSE and Amazon Linux have fixes for at least some kernels, and coverage varies within each distro.

What to do

Version numbers mislead because distros backport fixes, so check the changelog of the running kernel. If the command prints nothing, the running kernel lacks the fix.

Debian or Ubuntu:

apt changelog linux-image-$(uname -r) | grep CVE-2026-98432

RHEL and derivatives:

rpm -q --changelog kernel-$(uname -r) | grep CVE-2026-98432

Where a fix exists, update and reboot, since the update does nothing until the host boots into the new kernel. For self-built kernels, the fixed versions are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. The kernel team recommends moving to the latest stable release rather than cherry-picking the one commit.

Where no fix exists:

• Restrict network access to the affected hosts.
• Watch the vendor advisory for CVE-2026-98432 and patch the day the package ships.
• Optionally put an L7 load balancer or reverse proxy with TCP termination in front, to reduce direct exposure.

If Debian or RPM repos are proxied through Artifactory, the fixed kernel can be staged, promoted and rolled out in waves through that path.

Caveats

• Red Hat says no available mitigation meets its bar. Disabling MPTCP program by program is fragile, as the Go team notes: one forgotten listener re-exposes the host.
• Network restriction and proxying reduce exposure but do not fix the bug.
• Anthropic did not publish the exploit code. As of 2 November 2026, no attacks in the wild have been reported.
• Xray does not report the host kernel version, because the kernel is not in the scanned artifacts or images. The changelog check must be run by hand.
• Distro status in the post is dated 30 October and may have changed.