cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Linux TCP Flaw CVE-2026-98432 Rated 9.8; Anthropic Reports Root Exploit

· Original article ↗

Summary

CVE-2026-98432 is a Linux IPv4 TCP use-after-free; Anthropic says Claude generated an exploit for root access on servers with MPTCP listeners. Vendor severity scores differ, and Ubuntu and RHEL had no fixed kernels as of October 29.

Key points

  • The IPv4 TCP race can make the kernel read freed memory during connection setup; IPv6 is not affected.
  • Anthropic says Claude generated an exploit targeting servers with an MPTCP listener. It reportedly leaks a kernel address to bypass KASLR, then overwrites a callback pointer to execute a shell command as root.
  • Anthropic reported that its test took 48 minutes to leak a kernel address and five more minutes to reach command execution. It did not publish the exploit code, tested kernel version, or configuration; the risk on servers without an MPTCP listener is unclear.
  • Severity assessments differ: the kernel CVE team rates the flaw 9.8, while vendor scores range from 5.9 to 8.1; Amazon rates it 7.0.
  • Fixed packages were available for some Debian, Oracle Linux, SUSE, and Amazon Linux kernels. Ubuntu and RHEL had not released fixed kernels as of October 29.
  • The kernel fix is in specified stable releases, and users with available fixed packages are advised to update. The article reports no attacks using the flaw and no vendor-listed mitigation.

Article Details

Vulnerability Types
  • Race condition
  • Use-after-free
  • Buffer overflow
Severity
The Linux kernel CVE team rates it 9.8/10. Vendor ratings range from 5.9 to 8.1; Red Hat's CVE page rates it Moderate at 5.9, while its advisory file rates it Important at 8.1.
Affected Versions
  • Linux kernel versions beginning with 4.4; the article does not state an affected upper bound
Exploitation Status
not_reported
Exploit Availability
claimed_or_private
Patch Status
partial

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThe described exploit uses the kernel flaw to execute an attacker-chosen command as root.T1211 · Exploitation for StealthThe exploit leaks a kernel address to get around KASLR before overwriting a callback pointer.

CVE

CVE-2026-98432A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale.

People

Xinyang GeAnthropic researcher credited by the kernel fix with reporting the bug.

Vendors

AmazonAs of October 29, Ubuntu and RHEL have not released a fixed kernel. Red Hat, Amazon, Oracle, and SUSE score the flaw between 5.9 and 8.1, lower than the kernel team's 9.8.AnthropicAnthropic said on October 27 that its AI model wrote an exploit that uses the flaw to let a remote attacker with no credentials run commands as root on Linux servers with a multipath TCP listener.OracleAs of October 29, Ubuntu and RHEL have not released a fixed kernel. Red Hat, Amazon, Oracle, and SUSE score the flaw between 5.9 and 8.1, lower than the kernel team's 9.8.Red HatA flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale.SUSEAs of October 29, Ubuntu and RHEL have not released a fixed kernel. Red Hat, Amazon, Oracle, and SUSE score the flaw between 5.9 and 8.1, lower than the kernel team's 9.8.

Products

Amazon Linuxusers, that fix arrives only in the vendor's kernel package. Debian, Oracle Linux, SUSE, and Amazon Linux have shipped fixed packages, at least for some of their kernels, but Ubuntu and RHEL have not.ClaudeAnthropic described the Linux exploit in an October 27 post about flaws that its AI model, Claude, found and exploited. The Hacker News covered the post on October 28. Claude wrote the exploit after "initial prompting,"Debian Linuxstable kernel branches." For distribution users, that fix arrives only in the vendor's kernel package. Debian, Oracle Linux, SUSE, and Amazon Linux have shipped fixed packages, at least for some of their kernels,Linux kernelA flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale.Oracle Linuxbranches." For distribution users, that fix arrives only in the vendor's kernel package. Debian, Oracle Linux, SUSE, and Amazon Linux have shipped fixed packages, at least for some of their kernels, but UbuntuRed Hat Enterprise LinuxA flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale.SUSEAs of October 29, Ubuntu and RHEL have not released a fixed kernel. Red Hat, Amazon, Oracle, and SUSE score the flaw between 5.9 and 8.1, lower than the kernel team's 9.8.UbuntuA flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale.

Related Articles