Linux TCP flaw CVE-2026-98432 gets a root exploit as Ubuntu, RHEL fixes lag

A critical bug in the Linux kernel's IPv4 TCP handshake, tracked as CVE-2026-98432, can be exploited remotely without a login, and as of Sunday morning (Nov. 1), Ubuntu and Red Hat Enterprise Linux still haven't shipped fixed kernels.

The flaw is a use-after-free, meaning the kernel reads memory it has already released. The kernel's own CVE authority scores it 9.8 out of 10, and Red Hat raised its rating to Critical on Oct. 30. The upstream fix shipped in stable kernels between Oct. 11 and Oct. 18.

What changed this week is the exploit. Anthropic, whose researcher Xinyang Ge reported the bug, said in a research post that "after initial prompting, Claude wrote an exploit" that lets a remote attacker "run arbitrary commands as root, without any credentials or user interaction" on Linux servers with a multipath TCP listener. Anthropic hasn't released the exploit.

How the bug works

When a server accepts a TCP connection, the kernel tracks the half-open handshake and saves any IPv4 options the client sent, so it can echo them in replies. According to the CVE record, the kernel handed those options to the new connection without copying them, and could free them while another CPU was still reading them to answer a retransmitted connection request.

All of this happens inside the kernel before any application code runs, so any Linux host accepting IPv4 TCP connections on an unpatched kernel is in scope. Eric Dumazet's fix changes two plain memory frees to versions that wait until every reader is done. IPv6 isn't affected by the main issue.

Anthropic said a lost race "only fails the handshake without crashing the whole system, so a determined attacker can retry indefinitely until they succeed." In its proof of concept, it took 48 minutes to leak a kernel pointer and another five minutes to reach root command execution.

Multipath TCP (MPTCP), an extension that lets one connection use several network paths, is more common than it sounds. The Go security team warned on Oct. 29 that "as of Go 1.24, Go programs enable MPTCP by default for listen sockets on Linux," and added that "the underlying bug is not specific to MPTCP."

Who has a patch

Red Hat's bulletin says the company "is expediting the release of fixes," but as of Sunday morning its CVE page listed no fixed RHEL kernel. Ubuntu's tracker still marks its kernels "Vulnerable" on every release, with work in progress for 26.10, 26.04, 24.04 and 22.04.

Others are further along. Debian has fixed kernels for bookworm and trixie, Amazon Linux lists every affected kernel as fixed, and AlmaLinux put fixed kernels in its testing repository on Oct. 30. Upstream, the fixed versions are 7.3, 7.2.10, 6.18.56, 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272.

A fixed kernel only helps after a reboot, and containers run on the host's kernel, so Kubernetes nodes and container hosts need the update too.

Until then, Red Hat offers an nftables rule that drops incoming IPv4 TCP packets carrying IP options, which ordinary traffic rarely uses. Red Hat said it "reduces exposure to this vulnerability but cannot fully prevent it":

table inet cve_2026_98432 {
    chain input {
        type filter hook input priority -310; policy accept;
        ip protocol tcp ip hdrlength > 5 counter drop
    }
}

Admins can list MPTCP listeners with ss -Mlnp. Go programs can turn the default off with GODEBUG=multipathtcp=0, though the Go team called a program-by-program approach "a fragile mitigation." Patching and rebooting into a fixed kernel is the real fix.

The bug isn't in CISA's Known Exploited Vulnerabilities catalog, and no attacks have been reported. But by Oct. 31, at least six public GitHub repositories claimed to include a race trigger or proof of concept, according to a running analysis by Atlas Security. It's the latest server bug this month to need urgent patching, after PHP2Shell and the HTTP2Shell Brotli flaw.