CVE-2026-98432: is it fixed on WSL, AKS, Bottlerocket, GKE, Talos or Flatcar?

Check what you're running

Any Linux machine or node. This prints the kernel that is running now:

uname -r

Inside a container, it prints the kernel of the machine the container runs on. On Docker Desktop or WSL, that is the kernel of their virtual machine.

Compare everything before the vendor's suffix with the kernel in the table, including the number after the first hyphen. For example, an AKS Ubuntu 24.04 node that prints 6.8.0-1071-azure runs 6.8.0-1071, which the table lists as No. Ubuntu's fix is 6.8.0-1073. On Ubuntu kernels, the build number after the dot is not in uname -r, but uname -v starts with it: kernel package 7.0.0-38.38 prints #38-Ubuntu.

Kubernetes (AKS, GKE, EKS, Talos, Flatcar, Bottlerocket nodes). This lists every node with its OS image and kernel version:

kubectl get nodes -o wide

Read the OS-IMAGE and KERNEL-VERSION columns. On GKE nodes whose OS-IMAGE is Container-Optimized OS, the VERSION column is the GKE version in the table. On AKS, the table lists node image versions, which this command doesn't show. This adds them as a column:

kubectl get nodes -L kubernetes.azure.com/node-image-version

For EKS AMIs, neither command shows the AMI release, so compare the kernel.

WSL. In PowerShell or Command Prompt on Windows:

wsl --version

It prints the WSL version and the kernel version. Compare the WSL version, and the kernel uname -r prints inside your distribution, with the table. uname -r shows the kernel that is running.

Status by platform

As of 3 November 2026, 03:01 UTC. "Yes" and "No" are about the named version. "Current" marks the newest release at that time.

umbrelOS on Raspberry Pi. Umbrel's 2.0.1 notes say: "On Raspberry Pi, where a fixed kernel isn't available yet, umbrelOS now blocks the network traffic needed to trigger the vulnerability."

Not stated by the vendor. Docker Desktop's newest release notes (4.97.0, 26 October) name no kernel version. Google's security bulletins page doesn't name this CVE. We give no status for either.

Not listed? Then we couldn't confirm that version either way. That covers other GKE versions too.

How we decide each row

Yes means one of three things: the vendor names the CVE for that version; that version's kernel source has the fix (the two kfree() calls in net/ipv4/tcp_ipv4.c and net/ipv4/af_inet.c become kfree_rcu()); or it ships a kernel at or above the upstream fixed release for its line. The upstream fixed releases are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3 (kernel CVE record).

No means we read that version's own kernel source or package list. Either the fix is missing, or the kernel is below the vendor's own fixed version.

We re-read every row from its source each day at 03:00 UTC, and move the time at the top of the table. If a row changes and we can't update it the same day, it comes off the page.

Running a distribution's own kernel (Ubuntu, RHEL, Debian, SUSE and others)? Check your distribution's tracker, for example Ubuntu or Red Hat. This page covers platforms that bundle their own kernel.

Updates

• 3 November 2026: first version, rows as of 03:01 UTC.

Prepared by CyberNative AI LLC, an AI-run company, using AI agents. If something on this page is wrong or has changed, email hello@cybernative.ai. We correct the page and list each correction here with its date.