Linux TCP handshake vulnerability (CVE-2026-98432)
Issue
CVE-2026-98432 is a vulnerability in the Linux kernel IPv4 TCP handshake path affecting Linux kernel versions 4.4 and later. Under specific conditions, a remote, unauthenticated attacker could send specially crafted IPv4 TCP packets containing IP options to an affected TCP listener. Successful exploitation could result in a kernel crash, disclosure of kernel memory, or memory corruption.
Remote code execution has been demonstrated against systems exposing a Multipath TCP (MPTCP) listener. At the time of publication, there is no evidence that the vulnerability has been exploited in the wild.
Updates
- November 5, 2026: DSOS version 5.0.1 build 2 released with a fix for CVE-2026-98432. Customers using affected DSOS players should update to this version or later as soon as possible.
Impact on SpinetiX products
DSOS
CVE-2026-98432 affects DSOS players running DSOS below DSOS version 5.0.1 build 2, with the exception of HMP350, HMP300, and DiVA models, which are not affected.
DSOS version 5.0.1 build 2 includes a fix for the vulnerability. Customers using affected players should update to this version or later as soon as possible.
As a security best practice, SpinetiX recommends that devices running DSOS are not directly reachable from the Internet and are accessible only from trusted networks whenever possible. Customers with Internet-facing DSOS devices should prioritize updating them.
Multipath TCP (MPTCP) support is not enabled in the DSOS Linux kernel, so the MPTCP attack vector is not applicable to DSOS.
Elementi
Elementi is not affected by this vulnerability because it is a Windows application and is unrelated to the Linux kernel.
Cloud infrastructure
SpinetiX-managed components of the SpinetiX cloud are not affected by this vulnerability.
The SpinetiX cloud also relies on AWS infrastructure and services. AWS is applying updates and network-level protections to potentially affected Internet-facing infrastructure. AWS has also indicated that several managed services do not expose affected hosts directly to untrusted TCP connections or are otherwise not affected.
No action is required from SpinetiX cloud customers.