A critical flaw in the **Linux** kernel's TCP implementation, tracked as **CVE-2026-98432**, poses a significant threat to various Linux distributions, including **Ubuntu** and **Red Hat Enterprise Linux (RHEL)**. The kernel's own CVE team has assigned it a severe CVSS score of 9.8 out of 10.  ### AI Model Demonstrates Exploitation On October 27, **Anthropic** announced that its AI model, **Claude**, successfully developed an exploit leveraging this vulnerability. The exploit allows a remote attacker, without requiring any credentials, to execute commands as root on Linux servers equipped with a multipath TCP listener. While the upstream kernel fix credits Anthropic researcher **Xinyang Ge** for reporting the bug, neither the CVE record nor the official fix explicitly mentions multipath TCP (**MPTCP**). The connection between **MPTCP** and the vulnerability stems from Anthropic's detailed post. ### The Nature of the Vulnerability The flaw is a race condition occurring during the setup of new IPv4 TCP connections. Specifically, it can lead to a use-after-free bug, where the kernel attempts to read memory that has already been deallocated. This vulnerability was introduced in **Linux** 4.4. The kernel fix, applied on October 5, addresses this by ensuring the kernel waits for other CPUs to finish reading IP options before freeing the associated memory. IPv6 connections are not affected, as the kernel copies options for them, preventing the race condition. ### Discrepancies in Severity Ratings Interestingly, there's a notable difference in how vendors are rating **CVE-2026-98432**. The kernel's CVE team's 9.8 score assumes an attacker can reliably trigger the race condition by resending TCP connection requests with IPv4 Record Route or Timestamp options. They rate the attack complexity as low, suggesting potential for information disclosure, memory corruption, or system crashes. In contrast, **Red Hat**, **Amazon**, **Oracle**, and **SUSE** have assigned lower scores ranging from 5.9 to 8.1. **Red Hat** initially rated it Moderate (5.9) due to the perceived difficulty of winning the race, suggesting a kernel crash as the most likely outcome. However, their machine-readable advisory later updated the impact to Important (8.1) with high confidentiality and integrity impact, aligning more closely with **Oracle** and **SUSE**'s 8.1 scores. These vendors rate attack complexity as high, differing from the kernel team's assessment. As of October 28, the **National Vulnerability Database (NVD)** reflected the kernel team's 9.8 score. ### Anthropic's Exploitation Methodology **Anthropic**'s exploit operates in two stages. First, the race condition forces the kernel to send extra bytes back to the attacker. Once a kernel address is leaked through this process, the attacker can bypass Kernel Address Space Layout Randomization (**KASLR**). Second, the same bug is leveraged to overflow a buffer, overwriting a callback pointer with the address of an attacker-controlled payload already in kernel memory. When the kernel attempts to call this pointer, the payload executes a shell command with root privileges. **Anthropic** noted that a failed race attempt only impacts that specific connection and doesn't crash the system, allowing attackers to persist. In their testing, leaking a kernel address took 48 minutes, with command execution achieved just 5 minutes later. It's crucial to note that **Anthropic** did not release the exploit code, specific kernel version, or configuration details used in their tests. While **Red Hat** indicates that any exposed TCP service could be vulnerable, **Anthropic**'s root exploit specifically targeted servers with an **MPTCP** listener. It remains unclear if systems without **MPTCP** enabled are susceptible to the same level of compromise. As of October 29, there are no reported active attacks leveraging **CVE-2026-98432** in the wild, and it has not yet appeared in **CISA**'s Known Exploited Vulnerabilities catalog. ### Patching Status Across Distributions While the upstream fix has been backported to all maintained stable kernel branches, its availability to end-users depends on vendor-specific kernel package releases. As of October 29, the patching landscape is varied: | Distribution | Vendor rating | Status as of October 29 | Fixed package or advisory | |---|---|---|---| | **Ubuntu** 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 | Priority High | Work in progress | None released | | **Ubuntu** 16.04, 18.04 and 20.04 | Priority High | Vulnerable | None released | | **RHEL** 8, 9 and 10, OpenShift 4 | Moderate, 5.9 (CVE page)<br> Important, 8.1 (advisory file) | Fix deferred | None released | | **RHEL** 7 | Not applicable | Not affected | Not needed | | **Amazon Linux** 2023, kernel6.18 package | Important, 7.0 | Fixed October 24 | `kernel6.18-6.18.56-125.164.amzn2023` (ALAS2023-2026-3251) | | **Amazon Linux** 2023, kernel6.12 package | Important, 7.0 | Fixed October 29 in Amazon's advisory; Amazon's CVE page still says pending | `kernel6.12-6.12.113-138.209.amzn2023` (ALAS2023-2026-3335) | | **Amazon Linux** 2<br> **Amazon Linux** 2023, kernel package | Important, 7.0 | Pending fix | None released | | **Oracle Linux** 7, 8, 9 and 10, UEK kernel | Important, 8.1 | Fixed October 16 | ELSA-2026-500397, ELSA-2026-500398, ELSA-2026-500399 | | **Debian** trixie (stable) | No score listed | Fixed October 16 | `linux` 6.12.113-1 (DSA-6568-1) | | **Debian** 12 (bookworm) | No score listed | Fixed October 17 and October 22 | `linux` 6.1.190-1 (DLA-4841-1) <br>`linux-6.12` 6.12.113-1~deb12u1 (DLA-4850-1) | | **SUSE Linux** Micro 6.2, openSUSE Leap 16.0 | Important, 8.1 | Fixed | `kernel-default` 6.12.0-160000.40.1 or later | | SLES 15 SP4 to SP6 LTSS, SLES 16.0, SLE Micro 5.3 to 5.5 | Important, 8.1 | In testing | None released | | SLES 15 SP7 | Important, 8.1 | Affected, fix in progress | None released | **Ubuntu** also lists its cloud, FIPS, and real-time kernels as vulnerable or in progress. **Red Hat** states its fixes are "currently deferred to a future update," with neither vendor providing specific release dates. ### Recommendations for IT Security Professionals Given the critical nature of **CVE-2026-98432** and the demonstrated remote root exploit, IT security professionals and privacy-conscious users should: * **Monitor vendor advisories:** Closely track official security advisories from your Linux distribution vendor for the release of patched kernel packages. * **Prioritize patching:** Once available, apply the kernel updates immediately to mitigate the risk of exploitation. * **Assess exposure:** Identify any Linux servers running affected kernel versions and, particularly, those with **MPTCP** listeners, as these appear to be the primary target for the demonstrated exploit. * **Implement defense-in-depth:** While awaiting patches, ensure other security controls are robust, including firewalls, intrusion detection/prevention systems, and strict network segmentation to limit potential attacker access. The differing severity scores from vendors underscore the importance of understanding the potential impact and prioritizing patches based on your specific environment and risk tolerance.