CVE-2026-98432 dental practice: The Internet Is Scanning

A dental practice back room where a Windows reception PC sits in front, while behind it a backup NAS, a firewall appliance and an imaging server glow with Linux-penguin-like silhouettes, all connected to a single incoming network cable probed by scanning light

November 12, 2026 The Internet Is Scanning for a Critical Linux Flaw — and the Quiet Appliances Running Your Practice Are on the List

Posted at 05:36h in IT Security by Raymond

When a dental practice thinks about “the computers,” it pictures the reception desk, the operatory workstations, and the server that runs the practice-management software — almost all of it Windows. So when a headline warns about a critical Linux flaw, it is easy to assume it belongs to someone else’s world. It does not. The quiet boxes humming in your back room — the backup appliance, the firewall, the imaging server, the network video recorder — are overwhelmingly built on Linux, and a newly disclosed kernel vulnerability puts exactly those devices in the crosshairs.

The flaw is tracked as CVE-2026-98432, and the internet is already being scanned for machines that have not been patched against it. For a practice that stores imaging and patient records behind these appliances, this is worth an hour of attention this week.

What CVE-2026-98432 actually is

The Linux kernel CVE team published CVE-2026-98432 on October 15, 2026 and rated it CVSS 9.8 — critical. Technically, it is a “use-after-free” bug in the kernel’s IPv4 TCP implementation: the networking code reuses a piece of memory it had already released. An attacker who sends a carefully crafted sequence of ordinary TCP packets can turn that mistake into memory corruption, a crash, or — in the worst case — the ability to run their own code on the device.

Three details make security teams nervous. It is remote (the attacker only needs network reach to the device), it is unauthenticated (no password, no stolen credential required), and it needs no user interaction (nobody has to click anything). The vulnerable code has been present since Linux 4.4, which means a very wide range of appliances and servers inherit it. Security researchers have already demonstrated a working path from the flaw to full “remote root” — complete control of the machine.

“But one vendor scored it lower” — why that is not an off-ramp

You may see conflicting numbers. The Linux kernel team scores this 9.8, while Red Hat rated it lower (5.9), because reliable exploitation depends on an attacker winning a timing “race condition” inside the kernel. That is a genuine technical nuance — but it is not a reason to relax.

Race conditions get won. Exploit code matures quickly once a flaw is public, and the gap between “hard to exploit” and “automated exploit kit” is often weeks, not years. The honest reading is: a lower vendor score means you may have a little more time, not that you are safe. When a critical flaw is being actively scanned for across the whole internet, the correct posture is to patch on the assumption that someone will make it work.

An abstract visualization of a TCP network packet arriving at a device and corrupting a block of memory that was already freed, depicting a use-after-free flaw in the kernel's networking stack — A use-after-free: the network code reuses a piece of memory it already released, and a crafted stream of TCP packets turns that mistake into control of the device.

Where the Linux actually lives in a dental practice

This is the part that catches practices out. Your staff never log into “Linux,” so it feels irrelevant — but it is running underneath a surprising amount of your infrastructure:

Backup and storage appliances (NAS). Most network-attached storage runs embedded Linux. These are the devices holding the copies of your data you would need after a disaster, which is exactly why attackers target them — the same lesson behind the ransomware campaigns now hunting practice backup NAS boxes directly.
Firewalls and routers. The appliance at the edge of your network — the one facing the internet — is very often Linux-based. A network-facing device is the highest-priority place to patch, because the attacker does not even have to get inside first.
Imaging and PACS servers. Many imaging archives and server appliances run on Linux under the hood, sitting on the same network as your sensitive radiographs.
Connected and IoT devices. Network cameras, VoIP phone systems, door controllers and some networked medical devices run stripped-down Linux too — the same broad, hard-to-track device sprawl that let a botnet quietly conscript hundreds of thousands of routers and cameras.

The reception PCs running Windows are not the exposure here. The exposure is the equipment nobody logs into and therefore nobody thinks to patch.

A split conceptual image showing two different severity scores for the same flaw, a high 9.8 on one side and a lower score on the other, with an arrow showing that exploitation still succeeds — Different vendors scored the same flaw differently — but ‘harder to exploit’ is not ‘safe,’ and researchers have already reached remote root.

How to tell whether your practice is exposed

You do not need to read kernel code to ask the right questions. Put these to whoever manages your network:

What Linux-based devices do we actually run? Ask specifically about the NAS/backup appliance, the firewall/router, any imaging or PACS server, cameras, and the phone system.
Which of them can be reached from the internet? Anything with a port forwarded, a remote-access feature, or a cloud-management tunnel is top priority.
Has each one received a firmware or kernel update since mid-October 2026? The fix for CVE-2026-98432 arrives as a vendor firmware or OS update — often it is not automatic on appliances.
Do any of these devices still receive security updates at all? End-of-life hardware never gets the patch, and that is a replacement conversation, not a patch one.

What to do now

The response is practical and bounded:

Inventory first. You cannot patch the Linux device you forgot you owned. Build (or ask your IT provider for) a simple list of every networked appliance, what operating system it runs, and whether it faces the internet.
Patch the internet-facing Linux devices first. Apply the vendor’s current firmware/kernel update to your firewall, any remote-access appliance, and anything with a port open to the outside world — then work inward to NAS, imaging and internal servers.
Shrink the attack surface. Close any port forward you do not truly need, and keep management interfaces off the public internet. A device that cannot be reached cannot be scanned.
Prioritise by what is being exploited. A flaw under active internet-wide scanning belongs at the top of the queue regardless of a single vendor’s lower score — the same discipline that makes network-facing appliances, like the Ivanti remote-access devices attackers rooted even when fully patched, the ones to watch most closely.

The bottom line

CVE-2026-98432 is a reminder that “we run Windows” is not the same as “we don’t run Linux.” The operating system is invisible precisely because it lives inside the appliances you rely on most — backup, firewall, imaging — and a critical, remotely-triggerable kernel flaw in those devices is a direct route to your patient data and your ability to recover.

If you cannot say with confidence which of your networked devices run Linux, which ones face the internet, and when each was last updated, that uncertainty is the vulnerability. Contact Compudent Systems for a network and device-patching review, and we will inventory your practice’s real Linux footprint and confirm the critical appliances behind your front office are patched and out of reach.

Sources & further reading:

The Internet Is Scanning for a Critical Linux Flaw — and the Quiet Appliances Running Your Practice Are on the List