> Source: [sk1000339](https://support.checkpoint.com/results/sk/sk1000339)

# sk1000339 - Check Point Response to CVE-2026-98432 - Linux kernel vulnerability

| Property | Value |
|----------|-------|
| Solution ID | sk1000339 |
| Date Created | 2026-11-01 |
| Last Modified | 2026-11-03 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, Spark Firewall (Locally Managed), Check Point Firewall, Scalable Platforms, Spark Firewall (Centrally Managed) |
| Versions | R82.10, R82, R82.00.X, R81.10.X, R82.20 |

## Symptoms

- * On October 15, 2026, the Linux kernel organization reported a vulnerability related to a race condition in an IPv4 TCP connection handshake, which can cause a potential memory disclosure and even remote code execution. The vulnerability is a use-after-free of the IP-options buffer during the IPv4 TCP handshake. It is triggered by a TCP connection carrying IP options and can be exercised on any multi-core system and amplified with Multipath TCP (MPTCP).  
  For more information about Firewall IP Options configuration, visit [sk62082 - How to allow packets with IP Options through Check Point Security Gateway](https://support.checkpoint.com/results/sk/sk62082)
* This issue received the ID [CVE-2026-98432](https://www.cve.org/CVERecord?id=CVE-2026-98432) with a CVSS score of 9.8.
* **Affected Products:**
  * Check Point Firewalls (Spark and Force appliances)
  * Check Point Management and Log Servers
  * Maestro Orchestrator
* **Affected Versions:**
  * R82.20, R82.10, R82
  * Spark Firewalls R81.10.x, R82.00.x
* **Non-Affected Versions:** R81.20 and lower.

## Solution

### Check Point Response

Check Point Firewalls are not exploitable by this vulnerability in their default configuration.

Spark Firewalls do not support Multipath TCP (MPTCP).

On Check Point Management servers, MPTCP is disabled by default, so the remote code execution path does not apply. No exploitation has been demonstrated in testing.

Two independent factors apply:

1. MPTCP is disabled by default. Check Point Firewalls use standard TCP instead, preventing the demonstrated remote code execution path that requires an MPTCP listener.
2. By default, Check Point Firewalls drop packets that contain the vulnerable IP options. Because this vulnerability relies on IP options, it cannot reach systems protected behind the Firewall.

<br />

To validate that MPTCP is disabled, run this command on the Firewall/each Cluster member/Management server:

# sysctl net.mptcp.enabled

This output indicates that MPTCP is disabled: net.mptcp.enabled = 0

The fix is planned for the release on November 11, 2026, as part of the Jumbo Hotfix Accumulators.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content