Critical Linux Vulnerability: Millions of Routers at Risk, Patches Scarce
A critical security flaw in the Linux kernel, identified as CVE-2026-98432, has put potentially millions of home routers at risk. Since most consumer networking hardware relies on the Linux kernel, the scope of this vulnerability is massive. While some manufacturers like Ubiquiti and MikroTik have already moved to provide fixes, many other major players remain in a state of uncertainty, leaving users to rely on mitigation strategies rather than official patches.
The vulnerability, tracked as CVE-2026-98432, resides within the Linux kernel's handling of new TCP network connections. The flaw is severe enough that the kernel team has assigned it a CVSS score of 9.8 out of 10. An attacker does not require a password or physical access to the device; they only need to send specially crafted connection requests. In a worst-case scenario, this could lead to a complete system crash or full remote code execution, allowing an attacker to take complete control of the router.
The vulnerability affects all kernels from version 4.4 onwards, which covers approximately the last ten years of Linux development. Security researchers from Anthropic have successfully demonstrated a working exploit, though they have not released the details publicly. While there are currently no reports of active exploits being used in the wild, the existence of a functional proof-of-concept makes the threat highly significant.
Manufacturer Status and Patch Availability
The situation varies significantly depending on the manufacturer. While some vendors have been proactive, others have yet to confirm their status or release updates. Notably, Ubiquiti has already confirmed the vulnerability and released patches for its UniFi OS devices, and MikroTik has issued an advisory with specific fixes for RouterOS 7. For many other widespread brands, the exact level of exposure remains an estimate based on the kernel version used.
Affected Systems Overview (as of November 4, 2026)
- Ubiquiti UniFi (Cloud Gateways, Dream Machines): Confirmed affected; fixes available in UniFi OS 5.1.35.
- MikroTik RouterOS 7: Confirmed affected; fixes available in versions 7.25.1 (Stable), 7.24.6 (Long-Term), and 7.26 Beta 5 (Development). RouterOS 6 is not affected.
- FRITZ!Box: Likely affected; no official manufacturer statement found yet.
- ASUS (ASUSWRT): Likely affected; no official manufacturer statement found yet.
- TP-Link, Netgear, Telekom Speedport: Likely affected, depending on the specific model; no official manufacturer statement found yet.
- OpenWrt and OpenWrt-based routers: Likely affected; no official project statement found yet.
- pfSense, OPNsense: Not affected (based on FreeBSD).
- Legacy routers with kernels older than 4.4 (Linux 2.6/3.x): Not affected.
The Importance of External Accessibility
It is important to note that a vulnerable router is only exploitable if an attacker can actually reach it. By default, most home routers block incoming connection requests from the internet. The risk becomes critical when remote access features are enabled, such as MyFRITZ! or HTTPS remote access on FRITZ!Box, web access on ASUS routers, or VPN servers operating over TCP. Notably, WireGuard is not affected as it utilizes UDP instead of TCP. Within a local network, almost every router is reachable, meaning a compromise of a single device—such as an unpatched smart home component—could allow an attacker to move laterally to the router.
Mitigation Strategies Without a Patch
Until official firmware updates are available for your specific device, several steps can be taken to mitigate the risk of exploitation:
Гика
