Linux kernel CVE-2026-98432 turns AI host reachability into the real risk

At a glance

What this is: NHI Mgmt Group's analysis, drawing on NetFoundry's blog post: CVE-2026-98432 shows that Linux AI hosts, including MCP servers and model endpoints, are exposed when public listeners remain reachable.

Why it matters: This matters because identity and access controls can stop a scanner from reaching a vulnerable service even when patching is delayed, reducing the chance that a kernel flaw becomes remote root access.

By the numbers:

• CVE-2026-98432 is a use-after-free in the Linux kernel’s IPv4 TCP handshake, scored 9.8 out of 10 by the kernel maintainers.

Context

CVE-2026-98432 is a kernel memory-safety issue, which means the risk sits below the application layer and affects any system that exposes a listening TCP service. When that service is also part of AI infrastructure, the operational gap becomes more visible: security teams often harden the workload but leave the port reachable.

Linux underpins much of modern AI infrastructure, so a kernel flaw on a model host is not a niche concern. NHI authentication matters here because the practical question is who can establish a connection to the host before any exploit code ever runs.

Key questions

Q: How do I reduce exposure to a Linux kernel vulnerability on AI hosts?

A: Reduce exposure by patching the kernel quickly, limiting which hosts can reach the vulnerable path, and removing unnecessary services from AI hosts. Use host firewalls, network segmentation, and least-privilege access to the affected service so a remote attacker cannot easily trigger the flaw. If patching is delayed, isolate the host and disable the exposed workload where possible.

Q: Why does network reachability matter so much for kernel exploits?

A: Network reachability matters because most kernel exploits need a path to the vulnerable code, often through a listening service, exposed API, or remote management interface. If the target is not reachable from an untrusted network, the attacker must first gain another foothold. Reducing exposure with segmentation, firewalls, and service binding narrows that attack path.

Q: How do identity-based overlays protect exposed services?

A: Identity-based overlays protect exposed services by placing an authentication and authorisation layer in front of the service, so only approved identities can establish authenticated sessions. They commonly use certificates, tokens, or mutual authentication to verify the caller before traffic reaches the application. That reduces direct exposure of the service to unauthorised network clients.

Q: What should teams do first when a kernel flaw affects a listening service?

A: First, reduce the service’s exposure by restricting who can reach the listening port, then patch or restart the affected component as soon as possible. If the flaw is reachable from untrusted networks, treat it as immediately exploitable and block it with firewall rules, segmentation, or temporary shutdown. Also review whether the service account needs the privilege it holds.

Technical breakdown

How the TCP handshake becomes an execution path

The flaw sits in the IPv4 TCP three-way handshake, where the kernel manages half-open connections before promoting them to established sockets. In this case, specific packet handling lets memory be attached to one state, then reused after it has already been freed when retransmission and CPU scheduling interact. That is why a network packet can turn into code execution. The important detail is that the vulnerability is reachable only when a service is listening on a TCP port, which is what gives the network path operational significance. See the Vulnerability Management Guide.

Practical implication: Treat every listening AI host as exposed until the inbound path is removed or tightly constrained.

Why AI infrastructure inherits classic Linux exposure

GPU training nodes, model-serving endpoints and MCP servers commonly run on Linux because the surrounding software stack assumes it. Containers, Python runtimes, orchestration layers and hardware drivers all sit on the same operating system substrate, so a kernel flaw affects the whole stack, not just one application. MCP servers are especially relevant because they are designed to accept connections from models or clients, which means they naturally create a reachable port unless the network design changes. The security question is therefore architectural, not just operational. See the AI Infrastructure Workload Identity Guide.

Practical implication: Map AI workloads to their exposed listener surface and treat that surface as part of the asset inventory.

How identity-based overlays change exploitability

An identity-based overlay shifts access control from network presence to authenticated session establishment. Instead of publishing a service on a public or broadly reachable address, the host accepts outbound-initiated connections that are authorised by cryptographic identity and mutual TLS. That changes the attack geometry: an unauthenticated scanner cannot simply connect to the listening port and trigger the bug. This does not remove the kernel flaw, but it can remove the remote precondition that makes exploitation practical. For AI environments, that distinction matters because patching windows are rarely zero. See the NHI Authentication Guide.

Practical implication: Place remote AI services behind authenticated overlays so reachability is not the default state.

Threat narrative

Attacker objective: The attacker wants root-level code execution on a reachable Linux host, especially one running AI workloads or tooling gateways.

1. Entry occurs when an attacker can send a crafted IPv4 TCP handshake to a listening Linux service on a reachable port.
2. Credential access is not the issue here; the exploit depends on network reachability rather than stolen access.
3. Escalation follows the kernel use-after-free, which can produce root-level code execution on the host.
4. Impact is unauthenticated remote code execution as root on exposed AI infrastructure or any other Linux TCP listener.

Breaches seen in the wild

• LiteLLM MCP auth bypass 2026: An exploited LiteLLM MCP auth bypass and default sk-1234 master keys let attackers steal AI gateway master and provider API keys.
• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Reachability is the governance gap this CVE exposes: a 9.8 kernel flaw only becomes a practical remote threat when a host is still open to inbound connections. Patch latency is expected, but exposure latency is often self-inflicted through public IPs, broad firewall rules and flat internal routing. For AI infrastructure, the control problem is not simply kernel hygiene, it is whether unauthenticated traffic can ever touch the service surface.

AI hosts inherit a machine-identity problem as much as a vulnerability problem: model-serving endpoints and MCP servers behave like any other networked service, but they are often treated as application plumbing rather than governed identities. When a service is reachable by default, the attacker only needs the port, not a credential. That makes network exposure a first-class identity control issue for Linux-based AI environments.

Public listeners create a remote exploit corridor: when a vulnerable host listens on TCP, the exploit path is already partially assembled for the attacker. The kernel bug may be low-level, but the enabling condition is high-level governance failure around exposure. Teams that inventory AI systems but ignore their externally reachable sockets are leaving the most important control point unowned.

MCP security should be treated as infrastructure governance, not just protocol hygiene: MCP servers are useful because they connect models to tools and data, but that same connection model creates a predictable inbound surface unless the deployment is wrapped in access control. The practical conclusion is simple: if the service must listen, govern who can reach it before asking whether the kernel is patched.

Named concept: exposure-first remediation: the control priority moves from fixing every flaw immediately to removing the network precondition that turns flaws into exploits. That approach is especially relevant where reboot windows, rolling updates and mixed kernel versions make instant patching unrealistic. Practitioners should make exposure reduction part of vulnerability governance, not a separate network exercise.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• Read next: Vulnerability Management Guide

What this signals

Exposure-first remediation: kernel security for AI infrastructure is increasingly a question of who can reach a service, not just which version is installed. That shifts operational ownership toward network architecture, service placement and identity-gated access paths, especially where patch windows are constrained by production uptime.

For teams running Linux-based model infrastructure, the practical signal is that vulnerability management and access governance are converging. A host that must remain online while unpatched should not remain broadly reachable, and that principle applies equally to GPU clusters, orchestration APIs and MCP services.

For practitioners

• Inventory every reachable AI host Identify GPU training nodes, model-serving endpoints, orchestration APIs and MCP servers that still accept inbound TCP connections.
• Move public services behind authenticated overlays Use an identity-based overlay or equivalent access layer so unauthenticated scanners cannot touch the listening port.
• Prioritise kernel patching by reachability Patch exposed Linux hosts first, especially where the kernel version still accepts inbound traffic from untrusted or broadly trusted networks.
• Reduce listener exposure before the next reboot window Remove public IP assignments, narrow inbound firewall rules and eliminate unnecessary listening services on AI infrastructure.

Key takeaways

• This kernel flaw matters because a listening TCP service turns a low-level memory bug into a remote execution opportunity.
• The most exposed systems are Linux AI hosts, especially GPU nodes, model-serving endpoints and MCP servers that accept inbound connections.
• Removing public reachability can block the remote exploit path while teams wait for a patch or a reboot window.

Related NHI Mgmt Group resources: NHI Authentication Guide · MCP Security Guide · AI Infrastructure Workload Identity Guide · Vulnerability Management Guide

Key terms

• TCP Three-Way Handshake: The TCP Three-Way Handshake is the connection setup process where client and server exchange three packets to establish a TCP session. Attackers can exploit it with spoofing and resource exhaustion attacks, so defenders monitor connection spikes, half-open sessions and abnormal SYN traffic, and tune filtering and rate limits.
• Use-after-free: A use-after-free occurs when code continues to read or write memory after it has already been released. In kernel networking paths, this often becomes a security issue because stale pointers can expose secrets, corrupt control flow, or crash the system under the right timing conditions.
• Listening TCP Port: A listening TCP port is a transport-layer endpoint on a host where a process accepts incoming TCP connections. It identifies a service that can be reached over the network, so firewall rules, binding address, and segmentation control who can connect to it.
• Identity-Based Overlay: An identity-based overlay is a security layer that controls access to a service using the caller’s identity rather than only network location. It usually authenticates clients with certificates, tokens, or similar credentials, then enforces authorisation before forwarding traffic to the protected service.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.