Linux kernel TCP UAF CVE-2026-98432 rated Critical
Anthropic researcher reported a PoC for remote root access on Linux servers with multipath TCP listeners.
95
Product
Linux kernel
- Mentions · 7d30
- Mentions · 30d86
- All mentions184
- First seenAug 13, 2026
- Last mentioned2h ago
Timeline
184 articles · newest firstLinux before several 5.x–7.x releases affected by CVE-2026-98432
Canada’s Cyber Centre urges administrators to review the linked material and apply updates when available.
44
Linux kernel TCP flaw CVE-2026-98432 allows remote root on MPTCP servers
Anthropic says an unreleased Claude model built a root exploit in about 53 minutes; no in-the-wild attacks are confirmed.
74
Go team warns CVE-2026-98432 can give RCE via MPTCP
Since Go 1.24, Linux listen sockets enable MPTCP by default; turning it off is only a fragile stopgap.
74
Linux MPTCP flaw enables remote root; Anthropic shows exploit (CVE-2026-98432)
The kernel use-after-free scores 9.8, hits branches back to 4.4, and needs an exposed MPTCP listener.
78
Linux kernel TCP use-after-free CVE-2026-98432 can crash Ubuntu
Ubuntu lists kernels through 22.04 LTS as affected, with fixes still in progress and no confirmed exploitation.
64
CISA says attackers exploit Linux kernel flaw CVE-2026-46300
Federal agencies face an October 31 deadline; CISA says the bug is chained to plant PHP webshells and run as root.
84
Linux TCP use-after-free CVE-2026-98432 yields lab remote root
Upstream CVSS is 9.8 and Red Hat scores 5.9; Anthropic’s root chain used a lab Multipath TCP listener.
66
Attackers chain PHP2Shell with Fragnesia kernel bug for root
Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.
84
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
84
Warp Panda used VMware ESX zero-day; firewalls rooted and crashed
CISA set November 11 and October 31 federal deadlines; Cisco says CVE-2026-76418 is crashing firewalls with no workaround.
84
CISA adds VMware ESX and Linux kernel flaws to KEV
Agencies must fix CVE-2026-41709 by November 11, 2026, and Fragnesia CVE-2026-46300 by October 31, 2026.
74
Linux TCP use-after-free scored 9.8; Ubuntu and RHEL unfixed
Anthropic says Claude built a remote root exploit via MPTCP, a link absent from the CVE and fix.
76
Claude research model wrote a root exploit for Linux CVE-2026-98432
Anthropic calls it a lab test, not a real incident; upstream kernels are patched but several Ubuntu releases remain vulnerable.
76
CISA warns Fragnesia Linux flaw is chained in PHP2Shell attacks
Agencies must patch CVE-2026-46300 by Saturday 10; researchers say the chain rooted 25 servers, including three US government-affiliated hosts.
88
Linux kernel IPv6 AH routing header bug enables local privilege escalation
ZDI rates CVE-2026-80844 at CVSS 8.8; an attacker needs low-privileged code execution first.
48
Linux kernel CIFS use-after-free can escalate privileges locally
CVE-2026-72315 is rated CVSS 7.2 and requires the attacker to already run high-privileged code.
36
Linux kernel XFRM use-after-free allows local privilege escalation
ZDI rates CVE-2026-98231 at CVSS 7.8; low-privileged local code execution is required first.
44
Linux kernel Logitech HIDPP use-after-free allows local privilege escalation
ZDI rates CVE-2026-93826 at CVSS 7.8 and requires existing low-privileged code execution.
44
Attackers chain PHP2Shell and kernel exploits for root on 25 servers
Dream says custom exploits for CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300 reached government-affiliated firewalls and Active Directory.
76
PHP2Shell campaign roots 25 servers, including U.S. government-linked hosts
Dream says a custom exploit plus a Linux kernel bug rooted firewalls in the U.S., Japan, Taiwan, and South Korea.
86
Anthropic says unreleased Claude built Chrome, Android and Linux exploits
Vendors were notified first; Chrome 156 fixed 62 CVEs, and the Linux root flaw is CVE-2026-98432.
82
Unreleased Claude model wrote Chrome, Linux and Android exploit chains
Anthropic says the lab-only chains were reported first and fixed, including Chrome 156, with no real-world incidents.
74
China-linked hackers root firewalls via PHP2Shell and Fragnesia
Dream says attackers exploited 25 of 19,000 internet-facing firewalls on October 23-24 and planted root webshells on 24.
80
CISA adds VMware ESX and Linux kernel flaws to KEV
CVE-2026-41709 and CVE-2026-46300 are actively exploited; BOD 26-04 requires FCEB agencies to prioritize them.
80
ESET reviews a week of PHP, kernel, and LiteLLM incidents
PHP fixes shipped October 21; nine firms, including ESET, told NBC News they had seen no successful PHP2Shell attacks.
58
Anthropic's unreleased model chained flaws into patched OS exploits
Lab proofs, not live attacks, covered Chrome 156, iOS 26.5.2, Windows CVE-2026-33096, and Linux CVE-2026-98432.
74
CISA KEV: Linux kernel CVE-2026-46300 due October 31
The flaw can alter page-cache data and, chained with two other CVEs, implant PHP webshells that run as root.
86
Public Linux kernel root exploit appears before a CVE or fix
Sysdig says six ZDI reports went to lists on October 20–21, and several still lack a released-kernel fix.
74
OpenAI and Anthropic say frontier models broke containment controls
OpenAI named four container and kernel flaws and said more vulnerabilities it found are still undisclosed.
74
Torvalds backs AI use by competent kernel developers, not drive-bys
Kernel maintainers are dropping the Assisted-by tag, so submitters no longer must disclose AI use.
34
Unpatched Linux KSMBD flaws disclosed, including two remote code execution bugs
Neither CVSS 9.0 KSMBD issue had a CVE or a mainline fix as of October 23, 2026.
74
Unpatched Linux KSMBD flaws rated CVSS 9.0 posted before fixes
ZDI reports describe remote code execution in the kernel SMB server; no CVE or mainline fix is named.
76
pwn.watch lists GitLab RCE, leaked kernel bugs and LiteLLM compromise
The same live feed also covers BIND GSS-TSIG memory corruption, Node.js security releases, bank AI-agent logins and a Railway environment-variable incident.
68
Unpatched Linux kernel flaws posted to the public LKML
Trend Micro ZDI reports include two CVSS 9.0 remote code execution issues; mainline fixes are not out, though some patches are in testing.
72
Linux networking flaw lets KVM guests escape to the host
Pwn.ai leaked host memory on Vercel production sandboxes and gained root on lab hosts; guest-only updates do not fix it.
84
Linux kernel patch closes PwnEscape KVM guest-to-host escape
CVE-2026-99999 lets an x86 KVM guest alter already-validated IP packets, read host memory, and potentially run code.
74
Linux KVM guest-host escape PwnEscape rated 9.3
Malformed IPv4 checksum metadata can cross the guest-host boundary; an upstream kernel fix is reaching major distros.
78
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)
Researchers show CVE-2026-99999 lets a KVM guest escape to the host via Linux checksum handling.
76
Linux bugs fixed per release over time: >2× rise since 2026-04
Linux 7.2 was the kernel's second-busiest release, while bugs fixed per release more than doubled since April 2026.
38
Related CVEs
by mentions- CVE-2025-10263<1%9.1Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 &…
- CVE-2026-98432<1%9.8Use-after-free in Linux kernel IPv4 TCP options
- CVE-2026-4630016%7.8Shared-frag marker loss in Linux kernel skb coalescing (LPE)
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2025-399642%5.5Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg)
- CVE-2026-99999<1%9.3Linux kernel IPv4 checksum metadata can corrupt headers
- CVE-2026-53221<1%9.8Linux kernel: ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
- CVE-2026-53131<1%9.4Linux kernel: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`…
- CVE-2025-38724<1%7.8Linux kernel: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that…
Appears with
- Canonicalvendor · 64
- Canonicalorganization · 36
- Ubuntuvendor · 35
- Ubuntuorganization · 27
- Ubuntuproduct · 25
- CISAorganization · 23
- Linuxvendor · 19
- Zero Day Initiativeorganization · 16
- Microsoftvendor · 14
- Red Hatvendor · 13
- Anthropicorganization · 10
- Armvendor · 9
- KVMproduct · 9
- Oraclevendor · 9
- Claudeai model · 9
- Googleorganization · 8
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.