Assess this Linux server for CVE-2026-98432 using a read-only investigation. Work only on systems I own or am authorized to assess. Do not send exploit packets, run a proof of concept, install software, change firewall/sysctl settings, patch, drain nodes or reboot.

1. Identify whether you are on the host, in a container, or in a VM. Collect /etc/os-release, uname -r, architecture, installed kernel package versions and boot time. If containerized, explain that the shared host kernel must be assessed and request host-level evidence.
2. Consult current official distribution/provider advisories for CVE-2026-98432. Cite exact URLs and retrieval dates. Match the running kernel to the correct distribution release, package flavor and vendor fixed build. Account for backported fixes. Do not classify by upstream version alone. If no matching advisory or evidence is available, report UNKNOWN and explain what is missing.
3. Distinguish installed patched kernels from the currently running kernel. Check reboot status using available distribution tools. If livepatch is used, verify explicit coverage for this CVE and that the patch is active on this kernel; the presence of a livepatch agent is insufficient.
4. Inventory IPv4 TCP listeners with ss -lntp (or an available equivalent). Explain wildcard and dual-stack listeners. Inspect available host firewall rules read-only. Ask for cloud security groups, NACLs, load-balancer listener/target configuration, public routes and any direct-origin access that local evidence cannot establish. Separate kernel patch status from network reachability. Treat internal untrusted paths as relevant too.
5. For Kubernetes/ECS, assess node or container-instance kernels, current node image/AMI and replacement templates; a rebuilt container image does not update the shared host kernel. Identify which infrastructure is provider-managed and which is customer-managed.
6. Record MPTCP settings and relevant Go listener configuration as context only. net.mptcp.enabled=0, absent MPTCP support or GODEBUG=multipathtcp=0 do not prove the underlying TCP vulnerability is fixed. IPv4 options differ from TCP options.

Return a concise evidence table with: host/node, OS and kernel package, running kernel, vendor advisory and fixed build, active livepatch evidence, IPv4 listener/reachability evidence, patch status (PATCHED / VULNERABLE / UNKNOWN), exposure (REACHABLE / RESTRICTED / UNKNOWN), recommended action, owner and validation step. Report inaccessible evidence explicitly. Never label a host safe because it has no public IP or because a scan found no open port.

Finish with a prioritized remediation plan for review: vendor-supported patched kernel plus controlled reboot/node replacement, or a supported active livepatch covering this CVE; temporary vendor-recommended IPv4-options filtering and access restrictions where needed. Include availability checks, rollback planning and post-change verification. Propose commands separately; execute no changes without my approval. Do not read or print credentials, environment secrets, private keys or unrelated application data.