Linux TCP CVE-2026-98432: 9.8 Remote Kernel Flaw Fixed

CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP code that a remote, unauthenticated attacker can trigger by sending connection requests with IPv4 options to any listening TCP port. The kernel CVE team rates it 9.8, Red Hat raised its rating to Critical, and the bug has existed since Linux 4.4. Red Hat has shipped fixed kernels for RHEL 8, 9 and 10, while Ubuntu's fixes are still in its opt-in testing channel.

The bug is a race in how the kernel handles a new IPv4 TCP connection. When a server accepts the connection, the kernel hands the IP options from the incoming request to the new socket without copying them. If the client retransmits its SYN while another CPU is still building a SYN-ACK from those same options, the kernel can read memory it has already freed. An attacker triggers it by sending SYNs that carry IPv4 Record Route or Timestamp options. No login is needed, and IPv6 is not affected on the main path, according to The Hacker News and the NVD entry.

What pushed this bug from a quiet kernel fix into the headlines is a proof of concept nobody has seen. Anthropic said on October 27 that an unreleased internal Claude research model wrote a remote root exploit for the flaw that works against Linux servers with a Multipath TCP (MPTCP) listener, with no credentials and no user interaction. In that proof of concept, leaking a kernel address took 48 minutes and reaching a root shell took another 5. Anthropic has not published the code. Separately, trigger-only code that detects the kernel echoing freed memory in a SYN-ACK has appeared on GitHub; it does not achieve code execution.

Is CVE-2026-98432 being exploited?

Not that anyone has reported. No vendor, CERT or the kernel CVE team has published evidence of attacks, and the flaw was not in CISA's Known Exploited Vulnerabilities catalog as of November 3. Its EPSS score is 0.8% (55.3th percentile). That number deserves caution: EPSS is known to undersell fresh kernel bugs, and a working remote root exploit is known to exist even if it is private. The rating spread also matters. Red Hat first rated the flaw Moderate at 5.9 before raising it to 9.8, while Amazon Linux rates it 8.1 and Important, saying the main outcome is a crash with possible memory corruption.

Which Linux distributions have a fix for the TCP flaw?

Check your running kernel with uname -r and compare it with your vendor's fixed version. Details are in Red Hat's bulletin RHSB-2026-016 and Canonical's CVE page.

How do you mitigate CVE-2026-98432 before patching?

Red Hat published an nftables rule that drops inbound IPv4 TCP packets carrying IP options (any packet with an IP header length above 5). It blocks the known trigger but, Red Hat says, cannot fully prevent exploitation and may break workloads that rely on IPv4 options. It also only protects the host where it is loaded, so traffic between containers on the same host can bypass it. Some guides suggest disabling MPTCP; Canonical says the flaw is in the IPv4 TCP path, not MPTCP, so that alone is not enough. Ubuntu admins who cannot wait can enable the -proposed pocket for the kernel packages, then reboot. Every fix needs a reboot, so plan the maintenance window rather than assuming a package install closed it.

Our read

An AI model reportedly wrote a working remote root exploit for a fresh kernel bug, and the timeline is the story: under an hour from address leak to root shell. Whatever you think of the claim, the defender's takeaway is practical. The gap between "fix is upstream" and "fix is running on my servers" is now the dangerous part, and here it includes a mandatory reboot and, for Ubuntu users, a testing-channel wait. Knowing which internet-facing hosts actually run a vulnerable kernel, and confirming after the reboot that they no longer do, is the work that counts. For why scores like EPSS lag on kernel bugs, see what EPSS is and what CVSS misses. For a recent kernel networking bug, see our coverage of the SCTPhantom flaw. To test what is reachable on your own exposed hosts, Nexus Void runs VAPT on web apps, APIs and mobile apps.

Reporting by The Hacker News; fixes per Red Hat and Canonical; CVSS and EPSS per NVD and FIRST.