Kernel Linux · Exploitation reported

Linux kernel TCP RCE: Red Hat ships fixes, Ubuntu still testing

Oct 29, 2026 · 3 min read

Tracked as CVE-2026-98432 and rated 9.8, the use-after-free in the Linux kernel's IPv4 TCP stack can be reached by a remote, unauthenticated attacker. Fixed kernels are now available for RHEL 8, 9, and 10, while Ubuntu's fixes remain in an opt-in testing channel with no date for a regular update. Apply the fixed kernel once it reaches the stable channel.

By HIFY Radar newsroom Updated 11/03/2026 09:48 AM Get this every day →← Back to the feed 9 sources

HighVulnerabilityExploitation reportedPartial fix

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

The Linux kernel has a serious flaw in its IPv4 TCP stack, rated 9.8 out of 10. A remote attacker with no credentials can run commands as root on exposed servers; Anthropic demonstrated a working exploit built by its AI. Red Hat shipped fixes for RHEL 8, 9 and 10; Ubuntu still has fixes only in its testing channel.

Why it matters

Internet-facing Linux servers running network services can be fully compromised, with memory disclosure, crashes or total takeover, before any login. Go 1.24+ programs on Linux accept Multipath TCP by default, the path used by the exploit, so exposure may be larger than teams assume. No attacks in the wild are known, per reports, but a researcher detected internet-wide scanning for exposed systems.

What to do

Install the patched kernel: RHEL 8, 9 and 10 are fixed and Debian shipped on October 16; on Ubuntu, weigh the testing channel until the stable update lands. Review exposed servers and Go 1.24+ services; cited workaround for Go apps: GODEBUG=multipathtcp=0.

For the technical team

CVE: CVE-2026-98432
Affected: Kernel Linux (pilha TCP IPv4) · Linux kernel 4.4 and later. Ubuntu (three newest LTS releases) and Red Hat Enterprise Linux 8, 9 and 10 listed as affected
Exploitation: Anthropic reported on October 27 that a Claude model wrote a working exploit that ran attacker-chosen commands as root on Linux servers with an MPTCP listener; the exploit took about 53 minutes in testing and was not publicly released. A researcher detected threat-actor scanning across the entire internet for exposed systems. @DarkWebInformer states no known attacks in the wild; an LWN commenter built a crash PoC in about an hour with Claude
Fix: Upstream fix: free inet_opt/ireq_opt only after an RCU grace period (commit e3f33b0a1d89d738e2b913dab519226eaf76e15b; backport 11a03ce3c4a62d84c10ccdfe47f8075006498568 in the 6.12.y branch). Fixed stable kernels per @DarkWebInformer: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Debian shipped on October 16; Red Hat published kernels for RHEL 8, 9 and 10; Ubuntu only in its opt-in testing channel, no date. Cited mitigations: GODEBUG=multipathtcp=0 for Go apps; firewall rule dropping TCP SYN packets with IPv4 options (e.g., iptables with u32); Red Hat states disabling MPTCP does not mitigate the flaw
Vector: Use-after-free race condition in the kernel's IPv4 TCP stack: SYN options (inet_opt/ireq_opt structures) are freed before other CPUs finish reading them. A retransmitted SYN with IP options, racing connection establishment in another thread, makes the first thread access the freed structure, enabling kernel memory disclosure, a buffer overflow with attacker-controlled payload, host crash or remote root. Network vector, no privileges, no user interaction, before application authentication. The publicized path requires a Multipath TCP listener; Go 1.24+ programs on Linux use MPTCP by default
More details: One report says the fix reached stable kernels on October 11; an LWN comment lists LTS fixes from October 15 (7.2.11, 6.18.57, 6.12.113, 6.6.159, 6.1.190, 5.15.223, 5.10.272), slightly different numbers from the tweet. The 9.8 score comes from the kernel's own CVE team; Red Hat rates it 5.9, calling the race hard to win and denial of service the most likely practical impact. MPTCP is only the publicized path; a commenter warns related bugs may exist elsewhere in the TCP stack. Debian, Oracle Linux, Amazon Linux and SUSE released fixes for at least some affected branches as of October 29; the Go security team warned about the MPTCP default on October 29

Timeline

11/03/2026 09:48 AM
Red Hat ships fixed kernels for RHEL 8, 9, and 10; Ubuntu fixes remain available only in the testing channel.
11/03/2026 08:29 AM
Ubuntu released test patches on its opt-in testing channel with no date for regular updates; Red Hat has already patched RHEL 8, 9 and 10, and disabling MPTCP does not mitigate the flaw.
11/03/2026 08:23 AM
Anthropic says its AI built a root exploit for the flaw; Debian patched it on October 16, while Ubuntu's fix remains in testing with no release date.

Want the next updates in your inbox? Get the daily edition →

See all 15 updates

11/03/2026 05:41 AM
Researcher detects threat actor scanning across the entire internet for exposed affected systems and assesses the number of potential targets as high, raising the likelihood of exploit development.
11/02/2026 01:28 PM
New advisory states the flaw affects Linux kernel 4.4 and later, with network vector, no privileges and no user interaction required.
11/02/2026 07:02 AM
Incident opened.
11/01/2026 07:36 PM
A technical disclosure details the race present since kernel 4.4: IPv4 TCP SYN options are freed before other CPUs finish reading them, so a single crafted SYN with IP options can leak kernel memory, crash the host, or possibly give remote root.
11/01/2026 07:35 PM
Fix reached stable kernels on October 11 and Debian has shipped it; Ubuntu and Red Hat remain unpatched, and Go 1.24 or later opens an MPTCP listener by default.
10/30/2026 06:11 PM
Disclosed exploit enables remote root on MPTCP Linux servers.
10/30/2026 05:53 AM
Go warns that Go 1.24+ apps on Linux accept multipath TCP connections by default, the vector used by the exploit; stopgap is GODEBUG=multipathtcp=0, with the real fix in the kernel.
10/30/2026 05:18 AM
Anthropic says the exploit, written by an unreleased Claude model, gives no-login remote root on servers with a multipath TCP listener; Debian shipped its fix on October 16.
10/29/2026 04:54 PM
Anthropic says Claude developed a working exploit that executed attacker-chosen commands as root on Linux servers with a Multipath TCP listener.
10/29/2026 01:58 PM
Kernel TCP flaw is now tracked as CVE-2026-98432; Anthropic says its AI model wrote an exploit giving uncredentialed remote attackers root.
10/29/2026 12:59 PM
Anthropic demonstrated an exploit running commands as root on servers using MPTCP; fixes shipped for some versions, but Ubuntu and RHEL remain unpatched.
10/29/2026 09:49 AM
Initial disclosure: a 9.8 use-after-free in the kernel's IPv4 TCP stack; the poster urges immediate patching.