Full Breakdown
Critical Linux Kernel TCP Use-After-Free (CVE-2026-98432)
By Drooid · · How we work
In this breakdown
01
Core Event – Vulnerability Details
CVE-2026-98432 is a race-condition flaw in the IPv4 TCP handshake path of the Linux kernel. When a new TCP connection is completed, `tcp_v4_syn_recv_sock()` hands the pending request’s IP options to the new socket without copying them. If another CPU answers a retransmitted SYN for the same request while the new socket is being freed, the options are freed with a plain `kfree()` while still in use, creating a use-after-free condition. The race can be triggered by an unauthenticated peer that sends a SYN with IPv4 Record Route or Timestamp options and then resends the SYN to try to win the race. IPv6 is not affected because the kernel copies the options for IPv6 connections. A secondary migration path exists when request sockets are moved between listeners, enabled only when `net.ipv4.tcp_migrate_req=1` or a specific eBPF program is used.
02
Background & Context
The Linux kernel CVE team published the vulnerability on 15 October 2026 and assigned a CVSS 3.1 score of 9.8 (Critical) on 24 October 2026. Red Hat, Oracle and SUSE rate the flaw 8.1, Amazon rates it 7.0, while Red Hat’s advisory also lists a 5.9 rating and characterises the practical worst case as a denial-of-service crash. The National Vulnerability Database had not added an independent score as of 28 October 2026.
Anthropic researcher Xinyang Ge reported the bug to the kernel team and is credited in the fix commit. On 27 October 2026, Anthropic posted that its Claude model generated an exploit that could let a remote attacker run arbitrary commands as root on Linux servers exposing a multipath TCP (MPTCP) listener. The exploit allegedly leaks a kernel address to bypass KASLR and then overwrites a kernel callback. No exploit code or kernel version was disclosed, and the CVE record does not mention MPTCP.
Visual evidence
Images from the story
03
Official Statements & Responses
- Kernel CVE team: Calls the race attacker-induced, low-complexity, and capable of leaking memory, corrupting memory, or crashing the system.
- Red Hat: Rates the practical impact as a denial-of-service crash and notes the fix is deferred.
- Ubuntu: Shows the 9.8 score and marks the issue as “High priority,” but provides no release date.
- Oracle: Fixed UEK packages released on 16 Oct 2026.
- Amazon: Fixed kernel for Amazon Linux 2023 released on 24 Oct 2026.
- Anthropic: Claims its AI-generated exploit can achieve remote root on servers with an MPTCP listener; no code or broader verification provided.
- Go Security Team: Notes Go 1.24 enables MPTCP by default on Linux; it can be disabled via `GODEBUG=multipathtcp=0`.
04
Criticism & Opposition
Rescana’s analysis notes that Anthropic’s exploit claims have not been independently verified and no public exploit code or vendor confirmation exists. The lack of disclosed kernel version or configuration makes reproducibility uncertain.
05
Conflicting Reports & Gaps
- Score discrepancy: Kernel team’s 9.8 rating versus Red Hat’s 5.9–8.1 assessments.
- Exploitation status: All sources agree no exploitation in the wild has been reported as of 29 Oct 2026.
- MPTCP relevance: The CVE record and vendor advisories do not mention MPTCP, while Anthropic’s exploit specifically targets MPTCP listeners.
06
What’s Next
Red Hat and Ubuntu have not announced release dates for patched kernels. Administrators should:
1. Deploy fixed kernels where available (Debian, Oracle Linux, SUSE, Amazon Linux).
2. Verify that `net.ipv4.tcp_migrate_req` remains disabled (default 0).
3. Disable unnecessary MPTCP listeners, especially in Go applications.
4. Monitor vendor advisories and kernel logs for indicators of exploitation.
Preparedness actions focus on reducing exposure until patched kernels become widely available across all affected distributions.