Linux TCP Flaw CVE-2026-98432 Still Unpatched on RHEL and Ubuntu
Security / analysis
Linux TCP Flaw CVE-2026-98432 Still Unpatched on RHEL and Ubuntu
The kernel team scores the use-after-free 9.8, Anthropic says its model wrote a root exploit for it, and the two biggest enterprise distributions have no fixed kernel.
A remote attacker needs no credentials to trigger CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP handshake (a SYN packet carrying IP options sent to any listening port, on kernels dating to 4.4). As of Oct. 30, Red Hat Enterprise Linux and Ubuntu had no fixed kernel.
The Linux kernel CVE team scores the flaw 9.8 out of 10 on the CVSS severity scale. Eric Dumazet's two-line upstream fix landed on Oct. 5, according to a TuxCare write-up, and the CVE was published Oct. 15. Nobody has reported exploitation in the wild, and the bug was absent from CISA's Known Exploited Vulnerabilities list as of Oct. 29, per Rescana.
What the bug does, and what it needs
When an IPv4 TCP connection completes, the kernel function tcp_v4_syn_recv_sock() hands the pending request's IP options to the new socket without copying them, Rescana said. If a retransmitted SYN makes another CPU build a SYN-ACK from the same options while they are being freed, the kernel reads freed memory.
The attacker needs a listening IPv4 TCP port and the ability to send SYN packets with options such as Record Route or Timestamp. The main race does not affect IPv6, according to AlmaLinux. A second path, through request socket migration, needs net.ipv4.tcp_migrate_req=1 or a BPF program that selects or migrates sockets, and both are off by default.
Anthropic's root exploit claim, dated Oct. 27
Anthropic's Frontier Red Team wrote on Oct. 27 that an unreleased internal research model wrote a working exploit for this bug after initial prompting. The exploit targets servers with a multipath TCP (MPTCP) listener, defeats kernel address randomisation by leaking a pointer, then overwrites a callback pointer to run a command as root.
Anthropic said a lost race fails only the handshake and does not crash the machine, so an attacker can retry. Its proof of concept took 48 minutes to leak a kernel pointer and about five more to reach command execution. The post withholds the exploit code, the kernel version and the configuration, and Anthropic has not named the model. TuxCare said it had not reproduced the exploit and found no independent public reproduction as of Oct. 30. AlmaLinux and Rescana credit Xinyang Ge as the reporter.
MPTCP is off by default on RHEL 8, 9 and 10. Go 1.24 and later enable it on listening sockets where the kernel supports it, TuxCare said, so a Go service can open an MPTCP listener on a host where nobody turned the feature on.
Who has a fix as of Oct. 30
| Distribution | Status |
|---|---|
| Debian 12 and 13 | Fixed |
| Amazon Linux 2023 (kernel6.12, kernel6.18) | Fixed; default kernel pending |
| SLES 15 SP4 to SP6, SLES 16.0 | Fixed |
| Ubuntu 22.04 to 26.10 | Fix in progress |
| Ubuntu 16.04 to 20.04 | Vulnerable, no fix released |
| RHEL 8, 9, 10 | Affected, no fixed kernel or date |
The table is TuxCare's, and TuxCare sells live-patching, so check your distribution's own tracker. AlmaLinux went ahead of Red Hat: its testing repository holds kernel-4.18.0-553.180.2.el8_10, kernel-5.14.0-687.61.2.el9_8 and kernel-6.12.0-211.69.2.el10_2, backported from stable 5.10, 5.15 and 6.12.
The 9.8 score depends on who is asking
- Linux kernel CVE team9.8 out of 10
- Ubuntu9.8 out of 10
- Red Hat, Oracle, SUSE8.1 out of 10
- Amazon7 out of 10
- Red Hat, initial rating5.9 out of 10
Source: Rescana and TuxCare, accessed 2026-10-31
The score overstates the risk for most hosts. The kernel team assumes low attack complexity, while Red Hat, Oracle and SUSE rate complexity high because winning the race is not guaranteed. Anthropic's retry-without-crash result is the reason a high-complexity rating may not protect anyone.
The sources also disagree on Red Hat. TuxCare said Red Hat moved from Moderate (5.9) to Important (8.1) on Oct. 29. Red Hat's CVE page now says the flaw is "rated as Critical severity" with a 9.8 base score, calls the figures preliminary and gives no fix status. It points to security bulletin RHSB-2026-016.
What to do before a kernel ships
Where a fixed kernel exists, install it and reboot. Where it does not, Rescana and AlmaLinux suggest checking net.mptcp.enabled, listing MPTCP listeners with ss -lnMp and confirming net.ipv4.tcp_migrate_req is 0. None of those steps is a fix. AlmaLinux also published an nftables rule that drops IPv4 TCP packets with headers longer than five words. It does not survive a reboot, can drop forwarded traffic, and Rescana said no vendor has confirmed it blocks the flaw.
Hosting customers have a dependency of their own. Akamai's Linode status page said at 01:55 UTC on Oct. 31 that it was deploying mitigations and had no evidence of exploitation on its compute platform. It told customers to apply upstream operating system updates when they arrive.
The Terminal covered a different attack on developer machines in the fake Claude Code 2.1.313 extension and a npm worm spreading through test accounts, neither of which touches the kernel.
AlmaLinux said it will move its testing kernels to production after community testing. Red Hat has not given a date.
Sources
More in Security
- 01Ivanti Connect Secure Zero-Day Chain Gave Root on a Patched VPN, and the Integrity Checker Misses ItVolexity dates exploitation to October 3, ten days before Ivanti's advisory; the root escalation step has no CVE and no fix in the sources reviewed.
- 02Alpine Logged GitLab CVE-2026-97229 Attacks Nine Days Before CISA Listed ItAlpine's incident report shows the CVSS 10.0 flaw was exploited against its own server on Oct. 20 and 21, and that two GitLab 19.3 builds it ran still carried the bug.
- 03KPMG Could Not Confirm the Deepfake in Capillary's €3 Million FraudCapillary Technologies blamed deepfake cloning in July, but the forensic audit it filed on Oct. 31 calls the loss a payment-diversion scam and says the missing recordings and phone data leave deepfakes unproven.
- 04AU Small Finance Bank Probes Leak Claim on Salesforce PlatformThe bank confirms an investigation into limited vehicle-loan data, while a group claiming Aadhaar, PAN and credit reports has released no samples.