NTAP-20261102-0001 v11: First BMC Firmware Fixes for CVE-2026-98432

As of v11, 11 November 2026, NetApp advisory NTAP-20261102-0001 is still Interim. Two of twelve AFF/FAS BMC and SP families now have firmware, and E-Series SANtricity OS has fixed releases. Since v9, two more families have moved from Under Investigation to Affected with no patch: StorageGRID BMC SG6260/SGF6212/SG120/SG1200 (v10, 10 November) and FAS/AFF BMC A250/500f/C250 (v11, 11 November). Most other BMC and Service Processor platforms, StorageGRID, ONTAP Select Deploy and ONTAP tools for VMware vSphere 10 are still Affected with no patch.

CVE-2026-98432 is rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). NetApp classifies exploitation as Public. Per the advisory summary, a remote unauthenticated attacker could execute commands with root privileges on the affected Linux kernels. The stated impact is disclosure of sensitive information, addition or modification of data, or denial of service.

ONTAP 9 remains on the Not Affected list. An ONTAP upgrade does not fix a controller's BMC or SP. The exposure is in those out-of-band management processors and in a set of appliances and tools around ONTAP.

What changed through v11

The advisory is now at version 11.0, nine days after the initial public release. Version 9 only corrected the download links for the two BMC firmware packages added in v8. Anyone who saved a v8 link should take the files from the current Fixes section. Versions 10 and 11 added no new fixes: they only moved more platforms to Affected.

Status by product (advisory v11.0, 11 Nov 2026)

Fixes available

The firmware and SANtricity packages are on the NetApp Support site and require a login. Use the links in the current advisory; do not reuse a copied v8 URL.

Affected, no fix yet

Still under investigation

Active IQ Unified Manager for VMware vSphere; Brocade Fabric Operating System Firmware; NetApp Console Agent OVA; NetApp HCI BMC H610S; NetApp SolidFire & HCI Management Node; NetApp SolidFire & HCI Storage Node (Element Software).

Notably not affected

ONTAP 9; BIOS on the AFF/ASA/FAS platforms listed in the advisory; SnapCenter Plug-in for VMware vSphere (moved in v3.0); StorageGRID BMC SG6060/SGF6024/SG100/SG1000 (moved in v6.0) and SG5812/SG5860; MetroCluster Tiebreaker; NetApp Console Agent (the OVA form is still under investigation); ONTAP Mediator.

The kernel flaw in short

The bug is a use-after-free in IPv4 TCP connection handling. A SYN that carries IPv4 options, then a retransmission (or a request-socket migration), can race so the kernel reads freed memory while building a SYN-ACK. No credentials and no user interaction are required. Native IPv6 is not the affected path.

NetApp lists vulnerable kernel ranges starting at Linux 4.4 (through 5.10.271, 5.11–5.15.222, 5.16–6.1.189, 6.2–6.6.158, 6.7–6.12.112, 6.13–6.18.55, 6.19–7.2.9, and 7.3 through 7.3-rc6). The CVE was announced on 15 October 2026:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

On 27 October 2026, Anthropic's Frontier Red Team described a working exploit against Linux servers that have a multipath TCP (MPTCP) listener: leak a kernel pointer to defeat KASLR, then overwrite a callback pointer, for remote root with no credentials. MPTCP is the demonstrated path, not a precondition of the bug. The race sits in plain IPv4 TCP.

That distinction matters for NetApp's StorageGRID note: StorageGRID does not expose any MPTCP ports. That removes the published exploit path. It does not remove the kernel bug, which is why StorageGRID is still Affected and why a workaround exists.

Apply the fixes that exist; isolate the rest

For the two BMC families and for E-Series, take the packages from the advisory's Fixes section and install them in the usual firmware or SANtricity maintenance window.

For StorageGRID, follow the official procedure in the advisory's Workarounds section. KB CSG-28196 is the entry cited there. A public how-to, How to apply the CVE-2026-98432 firewall mitigation on StorageGRID nodes (updated 3 November 2026), covers StorageGRID 11.8, 11.9, 12.0 and 12.1. It describes a NetApp script, run on the primary Admin Node, that drops inbound IPv4 TCP packets containing IP options and keeps that rule across StorageGRID firewall reloads, with no node or service restart. Use that official script and the steps in the KB, not a handwritten iptables or nftables rule. Review the environment first: anything that sends IPv4 TCP with IP options to the grid will be dropped.

NetApp has published no workaround for the remaining BMC and SP families, Select Deploy, ONTAP tools 10, Cloud Volumes ONTAP Mediator or the affected StorageGRID BMCs. Until firmware or a vendor workaround lands, isolate and filter the BMC and SP management network:

1. BMC and SP. Keep every controller's BMC or SP interface on a dedicated out-of-band management VLAN. Do not route it from user, server or storage data networks. Allow inbound only from jump hosts and the monitoring systems that need it. The management processor runs its own Linux kernel, independent of ONTAP.
2. E-Series, until the controller is on 11.90R7 or 12.10R1. Same treatment for controller management ports: management VLAN only, access limited to admin hosts.
3. Select Deploy, ONTAP tools 10, Cloud Volumes ONTAP Mediator. Restrict who can reach the appliance to admin subnets and the vCenter or ONTAP endpoints they talk to. Nothing on a general network, nothing on the internet.
4. Verify, don't assume. Scan from a user subnet and a server subnet to confirm the management IPs are unreachable. Flat networks where the SP shares a subnet with e0M or servers are the common gap.

That isolation is a practical control, not a NetApp-published workaround and not a fix. It only shrinks the set of hosts that can send the packet.

The same CVE on hypervisors

The same kernel flaw has already been patched on several hypervisors that often sit next to these arrays:

• Proxmox: PSA-2026-00080-1 (31 October 2026) lists the fix in proxmox-kernel-7.0.14-25-pve (and the signed package).
• XCP-ng 8.3 LTS: the 4 November 2026 security update ships a fixed kernel that needs a host reboot. If the reboot has to wait, the post points to an iptables mitigation in the Vates advisory that takes effect immediately. XCP-ng notes that the public exploit relies on MPTCP, which the 8.3 kernel does not have; the underlying bug is still present.
• Red Hat: RHSB-2026-016 covers RHEL 8, 9 and 10 (bulletin dated 30 October 2026, updated 4 November 2026).

Bottom line

Inventory BMC and SP models against the v11 table. Apply 18.7P2 or 19.5P2 where those packages apply, and move E-Series controllers to 11.90R7 or 12.10R1. Do not panic-patch ONTAP 9 clusters — ONTAP 9 is not affected. On StorageGRID 11.8 to 12.1, follow the official firewall mitigation from the Workarounds section and the public how-to KB. Everywhere else, keep the management plane on admin hosts only and confirm it with a scan. Re-check NTAP-20261102-0001: the advisory is still Interim, and ten of twelve AFF/FAS BMC and SP families are still waiting for firmware.

Sources

• NetApp NTAP-20261102-0001: CVE-2026-98432 Linux Kernel Vulnerability in NetApp Products, version 11.0, updated 11 Nov 2026
• NetApp KB CSG-28196: CVE-2026-98432 Linux Kernel Vulnerability in StorageGRID
• NetApp KB: How to apply the CVE-2026-98432 firewall mitigation on StorageGRID nodes, 3 Nov 2026
• Linux kernel CVE announcement: CVE-2026-98432, 15 Oct 2026
• Anthropic Frontier Red Team: Discovering and exploiting vulnerabilities in critical, real-world software with Claude, 27 Oct 2026
• Proxmox PSA-2026-00080-1: kernel TCP use-after-free (CVE-2026-98432), 31 Oct 2026
• XCP-ng: November 2026 Security Updates #2 for XCP-ng 8.3 LTS, 4 Nov 2026
• Red Hat RHSB-2026-016: use-after-free in kernel IPv4 (CVE-2026-98432)