Linux TCP use-after-free scored 9.8; Ubuntu and RHEL unfixed
Original title: Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
Anthropic says Claude built a remote root exploit via MPTCP, a link absent from the CVE and fix.
CVE-2026-98432 is a race in Linux kernel IPv4 TCP connection setup that can read freed memory. The kernel CVE team scores it 9.8, while Red Hat, Amazon, Oracle, and SUSE score it from 5.9 to 8.1. Anthropic says Claude wrote an exploit that, against a multipath TCP listener, lets an unauthenticated remote attacker run commands as root. As of October 29, Debian, Oracle Linux, some SUSE products, and some Amazon Linux kernels are fixed; Ubuntu and RHEL are not.
Unconfirmed: Anthropic’s exploit and MPTCP connection are not in the CVE record or fix, and real-world attacks are not reported.
- The bug was introduced in Linux 4.4; IPv6 is not affected.
- Kernel developers fixed it on October 5, before the CVE publication.
- Amazon Linux 2023 kernel6.18 is fixed in kernel6.18-6.18.56-125.164.amzn2023.
- Debian trixie is fixed in linux 6.12.113-1; RHEL 7 is not affected.
- Red Hat’s pages simultaneously show Moderate 5.9 and Important 8.1.
Impact: Claimed remote root command execution, or a kernel crash
| Product | Affected | Fixed in |
|---|---|---|
| Linux kernel | Introduced in Linux 4.4; IPv4 TCP | Upstream fix applied October 5 and backported to maintained stable branches |
| Ubuntu | 16.04, 18.04, 20.04, 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 | — |
| Red Hat Enterprise Linux | RHEL 8, 9, and 10; RHEL 7 not affected | — |
| Amazon Linux 2023 | kernel6.18 and kernel6.12 packages | kernel6.18-6.18.56-125.164.amzn2023; kernel6.12-6.12.113-138.209.amzn2023 |
| Debian | trixie and Debian 12 bookworm | linux 6.12.113-1; linux 6.1.190-1; linux-6.12 6.12.113-1~deb12u1 |
| Oracle Linux | Oracle Linux 7, 8, 9, and 10 UEK | ELSA-2026-500397, ELSA-2026-500398, ELSA-2026-500399 |
| SUSE Linux | Linux Micro 6.2 and openSUSE Leap 16.0 fixed; several SLES releases still pending | kernel-default 6.12.0-160000.40.1 or later where stated |
- 1.Install the named fixed kernel packages from Debian, Oracle, SUSE, and Amazon where available.
- 2.Treat listed Ubuntu and RHEL kernels as unfixed until those vendors publish packages.
- CVEs
- CVE-2026-98432
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×15 |
From the original article
6 min read at thehackernews.com
A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9. 8 out of 10 on the CVSS scale.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.