cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Linux TCP CVE-2026-98432 Rated Critical as Red Hat Ships Fixes and Ubuntu Updates Remain in Testing

· Original article ↗

Summary

CVE-2026-98432 is a Linux IPv4 TCP use-after-free rated 9.8; it may allow unauthenticated remote code execution. RHEL fixes are available, while Ubuntu updates remain in opt-in testing. No in-the-wild attacks have been reported.

Key points

  • The Linux kernel IPv4 TCP use-after-free, tracked as CVE-2026-98432, is rated 9.8 by the kernel CVE team; Red Hat raised its rating to Critical.
  • The race can occur when a client retransmits a connection request carrying IPv4 Record Route or Timestamp options while another processor reads those options.
  • Red Hat released fixes for RHEL 8, 9, and 10 on November 1; systems need a reboot after installation.
  • Ubuntu 22.04, 24.04, and 26.04 fixes are in the opt-in -proposed channel, with no regular-release date announced; older listed Ubuntu releases do not yet have fixes.
  • Red Hat's nftables workaround blocks the known trigger but may disrupt workloads using IPv4 options, does not fully prevent exploitation, and can be bypassed by traffic between containers on the same host.
  • Anthropic said an unreleased internal research model produced a remote root exploit, but it has not published the code. Public proof-of-concept code only triggers the race and detects freed-memory data.
  • No vendor, CERT, or the kernel CVE team has reported attacks using the flaw.

Article Details

Vulnerability Types
  • Use-after-free
  • Race condition
Severity
Critical; Red Hat and the Linux kernel CVE team rate it 9.8/10. Amazon Linux rates it 8.1 and Important.
Affected Versions
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux 10
  • Ubuntu 22.04 LTS
  • Ubuntu 24.04 LTS
  • Ubuntu 26.04 LTS
  • Ubuntu 20.04
  • Ubuntu 18.04
  • Ubuntu 16.04
Exploitation Status
not_reported
Exploit Availability
public_poc
Patch Status
partial
Workarounds
  • Red Hat published an nftables rule that drops inbound IPv4 TCP packets carrying IP options; it blocks the known trigger but cannot fully prevent exploitation and may break workloads that depend on IPv4 options.

MITRE ATT&CK

T1210 · Exploitation of Remote ServicesThe flaw can be triggered remotely by sending IPv4 TCP connection requests with Record Route or Timestamp options to a listening TCP port; Anthropic said its unreleased internal model produced a remote root exploit for servers with an MPTCP listener.

CVE

CVE-2026-98432Vendor / Product unavailableThe flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can lead to remote code execution, Red Hat and Canonical said.

Vendors

AnthropicAnthropic said on October 27 that an unreleased, internal Claude research model wrote a remote root exploit for the flaw that works against Linux servers with an MPTCP listener, with no credentials and no userCanonicalThe flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can lead to remote code execution, Red Hat and Canonical said.Debianthe flaw 8.1 and rated it Important, saying the main outcome is a crash with possible memory corruption. Debian, Oracle Linux, and SUSE shipped fixes in October. Amazon Linux was fixed across all packages betweenRed Hatkernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releasesSUSEImportant, saying the main outcome is a crash with possible memory corruption. Debian, Oracle Linux, and SUSE shipped fixes in October. Amazon Linux was fixed across all packages between October 24 and 30.

Products

Amazon LinuxAmazon Linux scored the flaw 8.1 and rated it Important, saying the main outcome is a crash with possible memory corruption. Debian, Oracle Linux, and SUSE shipped fixes in October. Amazon Linux was fixed across allClaudeAnthropic said on October 27 that an unreleased, internal Claude research model wrote a remote root exploit for the flaw that works against Linux servers with an MPTCP listener, with no credentials and no userLinux kernelFixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releasesOracle Linuxand rated it Important, saying the main outcome is a crash with possible memory corruption. Debian, Oracle Linux, and SUSE shipped fixes in October. Amazon Linux was fixed across all packages between October 24 andRed Hat Enterprise Linuxfor a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in itsUbuntuin the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date

Related Articles