A significant flaw in the Linux kernel’s TCP implementation, identified as CVE-2026-98432, poses a serious threat to popular distributions such as Ubuntu and Red Hat Enterprise Linux (RHEL). The kernel’s CVE team has assigned it a critical 9.8 out of 10 on the CVSS scale, indicating its potential danger.
Exploit Details and Distribution Impact
Anthropic revealed on October 27 that its AI model had identified a way to exploit this vulnerability, allowing remote execution of commands on Linux servers running a multipath TCP listener. Despite its severity, as of October 29, neither Ubuntu nor RHEL have issued updated kernels to address this flaw. Other vendors have rated the vulnerability between 5.9 and 8.1, reflecting varying assessments of its risk.
The underlying issue is a race condition in the TCP code for establishing new IPv4 connections, which can lead to a use-after-free bug. This occurs when the kernel unintentionally reads previously freed memory, creating potential security risks.
Vendor Responses and Patches
Efforts to patch the vulnerability have been underway. Anthropic’s contribution was acknowledged in the fix process, but the connection to multipath TCP (MPTCP) was highlighted solely by Anthropic’s analysis. MPTCP allows multiple network paths for a single connection, which requires explicit application requests on Linux.
While some distributions like Debian, Oracle Linux, SUSE, and Amazon Linux have released patches for certain kernels, others like Ubuntu and RHEL are still working towards a resolution. Red Hat has deferred its fix, and there is currently no set release date for updates from these vendors.
Understanding the Severity and Mitigation
The race condition occurs during the TCP handshake process. In IPv4 connections, the kernel fails to copy IP options correctly, potentially leading to memory corruption. This issue does not affect IPv6 connections due to different handling of IP options.
The CVE team rated the flaw critically based on its ease of exploitation, suggesting that an attacker could manipulate TCP requests to exploit the vulnerability. Red Hat and other vendors, however, consider the race difficult to win, resulting in lower severity scores.
Anthropic’s Exploit and Future Outlook
Anthropic’s AI-driven exploit demonstrates how attackers might leverage the flaw. The exploit involves two stages: first, obtaining kernel memory through race conditions, and second, executing commands by manipulating callback pointers. While no exploits have been reported in the wild, the potential impact underscores the need for vigilance.
Users are advised to install available kernel updates promptly. For those compiling their own kernel, updates in versions 5.10.272, 5.15.223, 6.1.190, and others include necessary fixes. Red Hat and Ubuntu are yet to release comprehensive mitigation strategies, highlighting the importance of staying updated with vendor advisories.
