Researchers at Anthropic built a working exploit for CVE-2026-98432, a use-after-free in the Linux kernel’s IPv4 TCP connection setup code, and used it to run commands as root on a server from the network without logging in. Anthropic’s write-up says the proof of concept took 48 minutes to leak a kernel pointer and another five minutes to reach command execution, and that a lost race only fails the handshake without crashing the system, so an attacker can keep retrying. The Linux kernel CVE team scored the flaw 9.8 out of 10; Red Hat rates it 5.9 and classes it as a potential denial of service because exploiting the race is complex.
The kernel advisory describes a race: a retransmitted SYN can be processed on another CPU while the child socket is being freed, so the kernel reads IP options memory that has already been released. BleepingComputer reports that the demonstrated remote-root attack needs a server with a Multipath TCP (MPTCP) listener, that the flaw also affects ordinary TCP connections (remote code execution has not been publicly shown without an MPTCP listener), and that it affects kernels back to version 4.4. MPTCP is not usually enabled by default, but BleepingComputer notes that since Go 1.24 Go programs enable it by default for TCP listeners on Linux when the kernel supports it, so some Go services may listen with MPTCP without the administrator knowing. The flaw was fixed upstream and backported to maintained stable branches, but distribution updates are still rolling out.
How to check if you’re affected
Affected products are Linux servers running a kernel without the fix, which per BleepingComputer includes Ubuntu, Red Hat Enterprise Linux and Rocky Linux. Status as of 30 October:
- Ubuntu: BleepingComputer, citing Canonical’s tracker, says 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 remain vulnerable with kernel fixes in progress.
- RHEL / Rocky Linux: RHEL 8, 9 and 10 are listed as affected with fixes planned; RHEL 7 is not affected. CIQ says no patched kernel had been published for its Rocky Linux 8, 9 and 10 builds as of 30 October.
- Debian: Debian’s tracker lists the fix in kernel package version 6.1.190-1 for Debian 12 (bookworm) and 6.12.113-1 for Debian 13 (trixie).
- Other distributions: BleepingComputer says Oracle Linux, Amazon Linux and SUSE have released fixes for some kernel versions; check your vendor’s advisory.
On each host, run uname -r to see the running kernel and compare it with your vendor’s advisory. To see whether MPTCP is on, run sysctl net.mptcp.enabled: CIQ says 0 means off and 1 means listeners may negotiate MPTCP (including Go 1.24+ services). CIQ also warns that turning MPTCP off alone does not remove the reachable path in plain TCP traffic.
If you cannot wait for a patched kernel, CIQ’s article documents an interim firewall rule that drops IPv4 TCP packets carrying IP options. CIQ warns it can drop legitimate traffic and says to test it on a non-production host first. When your distribution ships the fixed kernel, install it and reboot.
Sources
- Linux kernel CVE record: CVE-2026-98432
- Anthropic: Discovering and exploiting vulnerabilities in critical, real-world software with Claude
- CIQ: Mitigating CVE-2026-98432 on Rocky Linux 8, 9, 10, and LTS variants
- Debian Security Tracker: CVE-2026-98432
- Ubuntu: CVE-2026-98432
- Red Hat: CVE-2026-98432
- BleepingComputer: Critical Linux kernel flaw allows remote root attacks on MPTCP servers