A newly disclosed vulnerability in the Linux kernel, designated CVE-2026-98432, carries a nearly maximum severity score of 9.8. It impacts a broad array of Linux distributions including Ubuntu, Red Hat Enterprise Linux (RHEL), and others. The flaw was reported by an Anthropic researcher and pertains to a race condition in the kernel’s TCP connection setup.
What the Vulnerability Is
This bug lives in the portion of the kernel that handles setting up new IPv4 TCP connections. Specifically, when a connection is accepted, the kernel transfers certain IP options from a pending socket to a new one without copying them. If the new socket is destroyed while another CPU is still referencing those options—for example, when a connection request is resent—a use-after-free error can occur, allowing memory to be read that should no longer be accessible. The issue doesn’t impact IPv6 connections due to a different handling process that safely duplicates those options. The vulnerability was introduced back in Linux Kernel 4.4; it was patched upstream on October 5, with the CVE officially published October 15.
Severity & Exploit Details
The kernel CVE team assigns the flaw a CVSS score of 9.8 based on low estimated attack complexity and high potential impact—these include leaking kernel memory, corruption, or even executing arbitrary commands as root. However, other vendors differ. Red Hat initially rated the flaw as “Moderate” with a score of 5.9, citing the difficulty of reliably winning the race. Later, their advisory raised the severity to “Important”, with a score of 8.1. Oracle, SUSE, and Amazon also use the 8.1 rating in their advisories. Key here is the connection to multipath TCP (MPTCP): Anthropic’s proof uses an MPTCP listener to reach full remote root command execution without user credentials. For non-MPTCP setups, the record doesn’t confirm whether the same level of risk applies.
Where Patches Exist—and Where They Don’t
Several major distributions have already issued fixes. Debian, Amazon Linux, Oracle Linux, and SUSE have rolled out patched kernel packages for affected versions. In contrast, Ubuntu (including LTS versions from 22.04 through 26.10) and RHEL (versions 8, 9, 10) have not released stable fixes yet. Amazon Linux’s 6.18 and 6.12 kernel branches are now patched, while others are still in progress. Red Hat has deferred updates and clarified that no mitigation met its internal standards for broad deployment at this time. Ubuntu reports that cloud, real-time, and FIPS kernel variants remain vulnerable with no release date for fixes.
Exploit Method & Mitigation Timeline
Anthropic described a staged exploit: first, forcing the kernel to return extra bytes in response to a specially crafted connection request. Once a kernel address leaks, the attacker can bypass Kernel Address Space Layout Randomization (KASLR). Then the same race condition is used again to overwrite a callback pointer, allowing arbitrary command execution as root. In one test, leaking a kernel address took nearly 48 minutes; achieving root took only five more minutes. Note — neither the exploit code nor the kernel versions used were disclosed, and it’s unclear whether non-MPTCP listeners are fully exposed.
To mitigate risk, users should update to patched kernel versions: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, or 7.3. If relying on vendor kernels, track vendor advisories for updates. At present, preventative measures like disabling MPTCP or rejecting incoming connection requests with IP options have not been confirmed effective. So vigilance is required.
This flaw underscores how complex protocol handling and parallel CPU operations in the kernel can open doors for severe remote compromise. It’s a reminder that even mature features like TCP still carry risk. Infrastructure teams should prioritize patches, assess exposure (especially if using IPv4 with MPTCP), and stay alert for exploits in the wild. In a world where remote root should be impossible without credentials, this undermines a foundational security boundary—and trust in vendors’ response timelines may shift significantly if fixes are delayed further or used in active attacks.
