TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Linux kernel flaw CVE-2026-98432 is rated Critical, CVSS 3.1 9.8, and affects IPv4 TCP connection processing in unfixed kernels dating back to Linux 4.4. Upstream fixes and some distribution updates are available, but status varies: Ubuntu still listed its kernels as vulnerable on Nov. 1, 2026. Anthropic says its researcher used Claude to build an unpublished proof of concept for remote root access in a specific multipath TCP configuration.
Linux kernel vulnerability CVE-2026-98432, a use-after-free bug in IPv4 TCP connection handling, has received a Critical CVSS 3.1 score of 9.8, and fixes are available for several upstream kernel branches and Linux distributions. The flaw is reachable by a remote, unauthenticated peer, but patch availability differs by vendor; as of Nov. 1, Ubuntu listed its affected kernel packages as vulnerable.
The Linux kernel’s CVE Numbering Authority describes the flaw as “ipv4: free inet_opt and ireq_opt after an RCU grace period.” It involves IPv4 option data being freed while TCP connection requests are processed. The CNA’s severity rating is 9.8 out of 10, with network reachability, low attack complexity, no required privileges and no user interaction reflected in the score. Its notes describe possible disclosure of kernel heap contents, memory corruption or a system crash.
Upstream fixes were released in stages: versions 7.2.10 and 6.18.56 on Oct. 11; 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272 on Oct. 15; and 7.3 on Oct. 18, 2026. Linux versions from 4.4 onward are identified as affected if they lack the fix. Upstream branches older than 5.10 that have reached end of life will not receive upstream fixes, according to the source report.
Distribution status is not determined solely by the upstream version number, because vendors may backport patches. Red Hat shipped fixed kernels for RHEL 8, 9 and 10 on Nov. 1. Debian and Oracle Linux have also published fixes, while SUSE lists several products as fixed and others as in progress or affected. The report said AlmaLinux fixes were still in testing and that Ubuntu’s tracker showed affected packages as vulnerable at 6:15 p.m. CST on Nov. 1.
Risk Before Applications Receive Traffic
The bug sits in kernel code used during IPv4 TCP connection handling, before an application processes the connection. That makes patch status relevant to internet-facing Linux servers and to systems that host containers: containers use the host’s kernel, so replacing an application image alone does not address a vulnerable host kernel.
Anthropic said a researcher used its Claude model to produce a working proof-of-concept exploit that runs commands as root on Linux servers with a multipath TCP listener, without credentials. That is a reported capability for a particular configuration, not evidence that every vulnerable Linux server can be exploited in the same way. Anthropic has not published the exploit, according to the source report.
For administrators, the immediate issue is to identify the distribution and kernel package in use, check the vendor’s security notice, and apply the vendor’s fixed package where available. The CVSS rating signals serious potential impact, but actual exposure depends on the system’s kernel, configuration and vendor patch status.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Bose QuietComfort Wireless Noise Cancelling Headphones, Sandstone
Apple MacBook Air 15-inch (2026) with M5 chip, 16GB memory, 512GB SSD, Silver
As an affiliate, we earn on qualifying purchases.
Upstream Fixes and Vendor Timelines
The vulnerability was reported by Xinyang Ge of Anthropic. The upstream change was made by Eric Dumazet and reviewed by Kuniyuki Iwashima, according to the fix commit cited by Atlas. The CVE record was published on cve.org on Oct. 15, 2026. The National Vulnerability Database entry was still marked “Received,” without its own analysis, as of the report’s Nov. 1 check.
Vendors assign different ratings: Red Hat also rates the flaw Critical at 9.8, after raising its rating from Important on Oct. 30; SUSE rates it Important, Ubuntu High, and Oracle and Amazon Important at 8.1. These differences do not change the upstream issue, but reflect each vendor’s assessment and product scope. The report also states that the main issue does not affect IPv6 connections.
Distribution fixes may use package versions that do not match the upstream release numbers. For example, Red Hat’s Nov. 1 updates included specific RHEL 8.10, 9.8 and 10.2 kernel packages. Administrators should use their vendor’s advisory and package status rather than infer protection from an upstream version string alone.
“Claude wrote a working proof-of-concept exploit that runs commands as root on “Linux servers with a multipath TCP listener.””
— Anthropic, as reported by Atlas
Exposure and Patch Status Still Vary
The available information does not establish how often the affected multipath TCP configuration is deployed or whether the reported proof of concept works against every vulnerable kernel and configuration. Anthropic has not released the exploit, so its behavior cannot be independently assessed from the report alone. The report also gives no confirmed count of affected systems or evidence of exploitation in the wild.
Patch status was still changing on Nov. 1. Ubuntu’s tracker listed packages across its releases as vulnerable, with some marked “work in progress”; AlmaLinux packages were in testing rather than production. Red Hat said OpenShift Container Platform through RHEL CoreOS remained affected, along with certain other listed products. These are dated status snapshots, not a guarantee of current availability.
It is also not clear from the supplied material when all remaining distribution fixes will be published. The NVD had not completed its own analysis by the report’s stated check time, and the source does not provide a later update.
Check Vendor Advisories for Fixes
System administrators should check the security tracker for their specific distribution, kernel flavor and supported release, then install the vendor’s fixed package when it becomes available. A distribution may backport the correction without adopting the corresponding upstream version number, so package-level advisory status is the relevant check.
Organizations using Ubuntu, AlmaLinux, RHEL CoreOS or other products listed as affected should watch vendor advisories for updated status. The next developments to track are remaining package releases, updates to the NVD record and any further technical disclosure about the reported proof of concept. The source material does not specify a publication schedule for those updates.
Key Questions
What is CVE-2026-98432?
It is a use-after-free in Linux IPv4 TCP connection handling, involving option data processed during the TCP handshake. The Linux kernel CNA rates it Critical at CVSS 3.1 9.8.
Can it be exploited remotely without credentials?
The CNA’s scoring assigns network access and no required privileges. Red Hat says a remote, unauthenticated attacker could exploit a race condition for remote code execution. Anthropic separately reported a proof of concept for root command execution on servers with a multipath TCP listener; the exploit has not been published.
Which systems are affected?
The source report identifies Linux kernels from 4.4 onward as affected when they lack the fix. Distribution kernels may contain backported patches, so check the relevant vendor advisory rather than relying only on the displayed upstream version.
Are IPv6 connections affected?
The cited kernel fix commit says IPv6 is not affected by the first issue. The vulnerability described here concerns IPv4 TCP handling.
What should administrators do now?
Check the status for the exact Linux distribution and kernel package in use, then apply its fixed update when available. A new container image does not replace the host kernel or remediate a vulnerable host by itself.
Source: atlasum.net
