Linux Kernel TCP Flaw CVE-2026-98432 May Enable Remote Code Execution

Summary

CVE-2026-98432 is a Linux kernel IPv4 TCP use-after-free affecting kernel 4.4 and later. Anthropic reports a root-level exploit under MPTCP conditions; vendors have issued fixes, and no in-the-wild attacks were reported as of Oct. 29.

Key points

The flaw involves a race that can free IP options while another CPU is still using them during TCP connection handling; request socket migration can open a similar path.
Anthropic says an unreleased Claude research model produced an exploit that achieved root-level command execution on a Linux server with an MPTCP listener. Anthropic has not published the exploit or test configuration, and CloudLinux says it could not reproduce the claim.
The article identifies Linux kernel 4.4 and later as affected for reachable IPv4 TCP hosts. The demonstrated exploit required an MPTCP listener; the article notes that the broader attackability without MPTCP remains an open question.
The kernel CVE team rates the issue 9.8, while vendor scores range from 5.9 to 8.3, in part reflecting differing assessments of how difficult the race is to win.
No vendor advisory had reported exploitation in the wild as of October 29, 2026.
The primary remediation is to install a vendor-patched kernel and reboot. The article lists fixes for several upstream kernel branches and advises checking each distribution's tracker.
Interim exposure-reduction steps include disabling MPTCP, dropping IPv4 packets carrying IP options, or placing the host behind a separate load balancer; these do not fix the flaw.

Article Details

Vulnerability Types: Use-after-free
Race condition
Severity: Critical; the Linux kernel CVE team rates it 9.8/10, while vendor scores vary.
Affected Versions: Linux kernel 4.4 and later
Exploitation Status: not_reported
Exploit Availability: claimed_or_private
Patch Status: partial
Workarounds: Disable MPTCP by setting net.mptcp.enabled=0.
For Go 1.24 or later programs, set GODEBUG=multipathtcp=0; the article describes per-program disabling as fragile.
Drop IPv4 packets carrying IP options using the article's iptables rule: iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP.
Place the host behind a separate load balancer or managed service that terminates TCP before traffic reaches the host; a proxy on the same host does not provide this mitigation.