Linux kernel TCP flaw rated 9.8 gets a remote-root exploit

CVE-2026-98432 is a use-after-free vulnerability in the Linux kernel's IPv4 TCP connection setup. The bug appeared in kernel 4.4, and Aikido's advisory notes that the Linux kernel CVE team assigns it a CVSS 3.1 score of 9.8. AWS has stated that a remote, unauthenticated attacker could achieve remote code execution under certain circumstances. Patched kernels include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10; the kernel CVE team advises upgrading to the newest stable kernel instead of applying the fix selectively.

Anthropic reported that an unreleased Claude research model produced an exploit allowing a remote attacker to gain root on a Linux server with a multipath TCP listener, needing no credentials or user action. SC Media reported that the test defeated kernel address space layout randomization. It took 48 minutes to disclose a kernel address and another 5 minutes to obtain command execution, totaling 53 minutes; a failed race only affects that single handshake, permitting repeated attempts. According to The Hacker News, cited by Aikido, no vendor advisory had reported exploitation in the wild as of October 29.

Patches vary by distribution. Amazon Linux, Debian, Oracle Linux and SUSE have shipped packages for at least some kernels, while Ubuntu and Red Hat Enterprise Linux had not as of November 2. As of October 30, Ubuntu marked 20.04, 18.04 and 16.04 as vulnerable without a fix, while work on fixes was underway for 22.04, 24.04, 26.04 and 26.10. Red Hat listed RHEL 8, 9 and 10 as affected with no fixed kernel. Rocky Linux and AlmaLinux have released patched kernels ahead of Red Hat, Security Boulevard reported. Red Hat's CVE page rates the vulnerability at 5.9, noting that winning the race is difficult and the most probable outcome is a crash, whereas Ubuntu's CVSS 4.0 vector yields 8.3.

Administrators should apply a vendor kernel update and reboot, then check uname -r to confirm the running kernel matches the vendor's fixed version. Until a patch is available, Aikido and AlmaLinux suggest disabling MPTCP with net.mptcp.enabled=0 and GODEBUG=multipathtcp=0, and blocking IPv4 packets that carry IP options with an iptables or nftables rule. AWS said new Fargate tasks launched after 13:00 UTC on November 1 use the patched platform, and existing tasks retire on the user's task retirement settings.

Systems are affected if they run Linux kernel 4.4 or newer and have an IPv4 TCP port that an attacker can reach. AWS Lambda is unaffected because its functions have no public IPv4 TCP ports. The primary race condition affects only IPv4. The flaw is in standard IPv4 TCP handling, and the CVE record and kernel patch do not refer to MPTCP, so the Go Security Team cautions that systems without MPTCP listeners might still be vulnerable to comparable exploits; CloudLinux's kernel team stated it was unable to replicate the Anthropic finding.