Summary:

A flaw in the Linux kernel's IPv4 TCP handshake code can allow a malformed packet to corrupt kernel memory, and potentially crash the host. Redpanda does not distribute affected kernels, but is typically operated on systems that could be impacted.

Redpanda Cloud:

Due to network controls the threat surface for Redpanda Cloud products (BYOC, Dedicated, Serverless, Agentic Data Plane) is considered minimal.  Redpanda will patch the Cloud Clusters with updated kernel versions as they are released and tested.

Redpanda Self Hosted:

Redpanda Self Hosted users should evaluate this TSB to see if they are on an impacted kernel version, if there is a patch available, and if the patch is not available yet if they want to mitigate the known attack vector.

At the time of publishing this TSB the main known exploitable attack vector is via multipath TCP (MPTCP).

Severity:

High

Redpanda Products Exposed:

• Redpanda Self-Managed - Enterprise

• Redpanda Self-Managed - Community

• Redpanda Cloud - BYOC

• Redpanda Cloud - Dedicated

• Redpanda Cloud - Serverless

Release Affected:

This CVE impacts systems running Redpanda, and is not tied to any specific Redpanda release. Affected Linux kernels run from 4.4 up to the stable fixes below. 

Identification:

1. Check the kernel version on each broker host with uname -r and compare it with the table above and your distribution's advisory for CVE-2026-98432.

2. Check whether MPTCP is enabled with sysctl net.mptcp.enabled (1 means enabled).
   Example:

sysctl net.mptcp.enabled
net.mptcp.enabled = 1

If sysctl reports that /proc/sys/net/mptcp/enabled does not exist, the kernel has no MPTCP support.

Impact:

An unauthenticated remote peer that can reach a listening TCP port may be able to read or corrupt kernel memory, or panic the host. This affects broker availability and host integrity.

Suggested Actions:

1. Kernel Patch: If a patched kernel version is available upgrading is remediation.  After patching, perform a rolling restart on the hosts.

2. Disable MPTCP at the kernel level (Until you are able to patch the kernel): MPTCP is currently the main exploitable path, but may not be the only one.

sysctl -w net.mptcp.enabled=0
echo 'net.mptcp.enabled = 0' > /etc/sysctl.d/99-disable-mptcp.conf  

A. If you make this change the host will need to be restarted to recreate processes already using MPTCP.  Redpanda Core does not use MPTCP

Redpanda is investigating building hardened releases with MPTCP disabled by default.  Given the recent release of this CVE we want to evaluate if new attack vectors are discovered, and given the possible applications using MPTCP we recommend kernel patching or disabling at the kernel level.

Questions? If you have any questions on this TSB, or need further guidance, please contact Redpanda Support.