Linux kernel TCP flaw CVE-2026-98432 leaves Ubuntu and Red Hat without a fix

A newly disclosed flaw in the Linux kernel's TCP code is drawing attention because of how widely it reaches and how far researchers say it can be pushed. According to The Hacker News, CVE-2026-98432 is a race condition in the way the kernel sets up new IPv4 TCP connections that can lead to a use-after-free, and the Linux kernel CVE team added a 9.8-out-of-10 CVSS score to the record on October 24. Major distributions do not agree on that number, and some of them still have no fix available.

What happened

The Hacker News reports that the bug lives in the TCP handshake. When a connection completes, the kernel hands the IP options stored with the pending request to the new socket without copying them. If that socket is destroyed while another CPU is still using the options to answer a retransmitted connection request, the kernel reads memory it has already freed. The outlet notes that IPv6 connections are not affected because the kernel copies the options in that path. Kernel developers applied the fix on October 5, ten days before the CVE was published, by making the kernel wait until other CPUs finish reading the options before freeing them. Anthropic researcher Xinyang Ge is credited with reporting the bug.

How serious is it

Severity is where the sources part ways. The Hacker News writes that the kernel team rated attack complexity low and described both sides of the race as attacker-induced, warning the bug could leak nearby kernel memory, corrupt memory, or crash the system. Red Hat, by contrast, lists the flaw as Moderate (5.9) on its CVE page while its machine-readable advisory rates it Important (8.1); Oracle and SUSE also score it 8.1 and Amazon 7.0. Red Hat told the outlet the most likely outcome is a kernel crash and that no confidentiality or integrity impact has been demonstrated. According to the report, Red Hat's bug tracker raised the severity from medium to high on October 29.

The most striking claim comes from Anthropic. The Hacker News says Anthropic published a post on October 27 describing an exploit that gave a remote, unauthenticated attacker root command execution on Linux servers running an MPTCP listener. The outlet reports the exploit works in two stages: the race first leaks a kernel address to defeat KASLR, then overflows a buffer to overwrite a callback pointer and run attacker code as root. In the described test, the address leak took 48 minutes and command execution five more, and a lost race only failed one connection attempt, letting the attacker retry. The report adds that Anthropic's post does not say whether servers without MPTCP can be exploited the same way, and that Anthropic said its exploit was written by its Claude model after initial prompting.

Who is affected

The Hacker News says the flaw has been present since Linux 4.4 and lists a broad set of affected distributions, including Ubuntu 16.04 through 26.10, RHEL 8, 9 and 10 with OpenShift 4, Amazon Linux 2 and 2023, Oracle Linux 7 through 10, and several Debian and SUSE releases; RHEL 7 is not affected. As of October 29, no vendor advisory, the CVE record, or Anthropic's post reports attacks using the flaw in the wild.

What to do

The outlet advises installing the fixed kernel from your distribution where one exists. Debian shipped fixes for Trixie (linux 6.12.113-1 on October 16) and Bookworm, Oracle fixed its UEK kernels on October 16, and SUSE and Amazon Linux have released or are testing updates. Ubuntu lists fixes as in progress with no package released, and Red Hat says fixes are deferred to a future update with no mitigation that meets its deployment standards. Administrators who build their own kernels can move to one of the fixed stable releases the kernel team lists, such as 6.12.113, 6.18.56 or 7.3.