A Linux kernel TCP flaw, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL) and other distributions. The Linux kernel CVE team rates it 9.8 out of 10, though vendor assessments range from 5.9 to 8.1.
On October 27, Anthropic reported that its Claude AI model had developed an exploit capable of letting a remote attacker run commands as root on Linux servers with a multipath TCP (MPTCP) listener. The exploit requires no credentials. As of October 29, Ubuntu and RHEL had not released patched kernels, while Debian, Oracle Linux, SUSE and some Amazon Linux kernels had received fixes.
The flaw is a race condition in the kernel’s IPv4 TCP connection setup code. During a TCP handshake, the kernel passes IP options from a pending request to a new socket without copying them. If the socket is destroyed while another CPU is still using those options to respond to a retransmitted request, the kernel may access memory that has already been freed. This is known as a use-after-free.
The issue affects IPv4; the equivalent race does not affect IPv6 because the kernel copies the options for IPv6 connections. The bug dates back to Linux 4.4. A fix was committed upstream on October 5, before the CVE was published, and makes the kernel wait for other CPUs to finish reading the options before freeing them.
The upstream fix credits Anthropic researcher Xinyang Ge. The kernel fix does not mention MPTCP; that connection was described in Anthropic’s report. MPTCP allows a single connection to use multiple network paths, and Linux applications must explicitly request it when opening a socket.
Distribution fixes are delivered through vendor kernel packages, even when the upstream kernel has been patched.
The kernel team’s 9.8 score assumes an attacker can send TCP requests containing IPv4 Record Route or Timestamp options and repeatedly resend them to trigger the race. It rates the attack complexity as low, reasoning that an attacker can induce both sides of the race. Possible outcomes include leaking nearby kernel memory, corrupting kernel memory or crashing the system.
Red Hat’s CVE page rated the issue Moderate at 5.9, citing the difficulty of winning the race and saying a kernel crash was the most likely result. It noted that memory corruption was theoretically possible but that no confidentiality or integrity impact had been demonstrated. However, Red Hat’s machine-readable advisory, updated October 29, rated the issue Important at 8.1, and its bug tracker severity was raised from medium to high that day. Oracle and SUSE also assigned a score of 8.1, while Amazon rated it 7.0.
Anthropic said Claude developed the exploit after initial prompting. It described a two-stage attack:
According to Anthropic, losing the race affects only that connection attempt and does not crash the server, so an attacker can keep trying. In its test, obtaining a kernel address took 48 minutes, followed by five more minutes to reach command execution.
Anthropic did not publish the exploit code, the kernel version or the tested configuration. Its report describes targeting servers with an MPTCP listener, but does not clarify whether servers without one can be exploited in the same way. As of October 29, vendors and Anthropic had not reported attacks exploiting the flaw, and it was not listed in the available copy of CISA’s Known Exploited Vulnerabilities catalog.
Install a vendor-provided fixed kernel wherever one is available. For systems without a distribution package, upstream fixes are included in Linux versions 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. The kernel CVE team recommends updating to the latest stable kernel rather than cherry-picking individual fixes.
Ubuntu, RHEL and some Amazon Linux and SUSE releases did not yet have a patch available. Red Hat said it had no mitigation that met its requirements for broad applicability, ease of deployment and stability. Available advisories did not specify whether disabling MPTCP or filtering incoming connection requests containing IP options would reduce risk.
ChicagoVPS is your gateway to unparalleled hosting solutions. Our state-of-the-art datacenters and powerful network ensures lightning-fast speeds and uninterrupted connectivity for your websites and applications. Whether you’re a startup looking for scalable resources or an enterprise in need of enterprise-grade hosting, our range of plans and customizable solutions guarantee a perfect fit. Trust in ChicagoVPS to deliver excellence, combining unmatched reliability and top-tier support.
For Inquiries or to receive a personalized quote, please reach out to us through our contact form here or email us at sales@chicagovps.net.
