CVE-2026-98432 is a critical use-after-free vulnerability in the Linux kernel’s IPv4 TCP networking stack that has been present since Linux 4.4. The Linux kernel CVE team and Red Hat both assigned it a Critical rating and a 9.8 CVSS 3.1 score.
CVE-2026-98432: How the bug works
The flaw occurs during TCP handshake processing when the kernel passes IPv4 options to a new socket without making a fresh copy. If a retransmitted request is handled on a different CPU core at the same time, a race condition can let the socket be destroyed and its options freed while another core still references that memory, causing a use-after-free. The upstream kernel patch addresses this by adjusting memory cleanup timing using Read-Copy Update (RCU) grace periods so readers finish before memory is freed.
Proof-of-concept exploit and practical impact
On October 27 Anthropic demonstrated how Claude helped construct an exploit that achieved unauthenticated remote root command execution on a server running a multipath TCP (MPTCP) listener. The demonstrated attack targeted an MPTCP setup, but MPTCP is not required: the vulnerable IPv4 TCP code paths can also be reached through ordinary TCP connections. Anthropic reported the exploit spent about 48 minutes leaking kernel memory pointers to bypass KASLR, then about five minutes to launch a root shell. When the exploit missed the race window during testing, the connection typically dropped without crashing the host, allowing retries. How reliably this sequence works across different kernels and hardware remains an open question; a successful proof-of-concept does not automatically mean every unpatched Linux server is an easy target in practice.
Patches, vendor responses and mitigations
The Linux kernel team publicly disclosed CVE-2026-98432 on October 15 and upstream fixes have landed in supported stable branches. Distribution maintainers must still package, test and ship those updates to users. Patches are already available for Debian and Amazon Linux. As of November 2, Ubuntu is rolling out fixes. Red Hat lists RHEL 8, 9, 10 and OpenShift as affected and is fast-tracking updates; on October 30 Red Hat also warned that kernels with IPv4 TCP active and accepting inbound connections can be exposed. Red Hat shared a network filtering rule to help reduce risk in the interim but emphasized it is a temporary band-aid, not a replacement for a kernel patch.
Security teams should consult their Linux vendor’s specific advisory and apply vendor-supplied kernel updates as they become available.
