Critical Linux IPv4 TCP Flaw Enables Potential Remote Root Execution
Summary
CVE-2026-98432 is a critical Linux IPv4 TCP use-after-free that could enable remote root execution. Anthropic demonstrated an exploit, but no real-world exploitation was confirmed as of November 4, 2026; vendor kernel fixes are available.
Key points
- The race condition can free IPv4 IP-option memory while another CPU is accessing it, potentially causing a crash, memory corruption, or remote code execution.
- The flaw affects vulnerable Linux kernels dating back to version 4.4; IPv6 is not affected by this specific race.
- Anthropic demonstrated remote root execution against a Linux server with an MPTCP listener, using a kernel pointer leak to bypass KASLR before redirecting kernel control flow. The exploit code has not been released.
- MPTCP is not required for the underlying vulnerability; Red Hat says ordinary IPv4 TCP configurations, including default RHEL configurations, remain affected.
- As of November 4, 2026, the article reports no confirmed real-world exploitation and no publicly documented release of Anthropic’s complete remote-root exploit.
- Install a fixed kernel from the relevant Linux distribution and reboot. Upstream fixed versions include Linux 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3.
- Filtering inbound IPv4 TCP packets containing IP options can reduce exposure, but may affect legitimate workloads and is not a substitute for patching.
Article Details
- Vulnerability Types
- Use-after-free
- Race condition
- Severity
- Critical; CVSS 3.1 score 9.8
- Affected Versions
- Linux kernel 4.4 and later versions containing the vulnerable implementation
- Exploitation Status
- not_reported
- Exploit Availability
- claimed_or_private
- Patch Status
- partial
- Workarounds
- As an interim measure, filter incoming IPv4 TCP packets containing IP options; the article warns this is not a substitute for installing a fixed kernel.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationAnthropic demonstrated using the kernel vulnerability to achieve root command execution on a Linux server.T1210 · Exploitation of Remote ServicesThe article describes remotely triggering the Linux kernel vulnerability with specially timed IPv4 TCP connection requests to an exposed service.
CVE
People
Vendors
Products
Linux kernelA critical vulnerability in the Linux kernel’s IPv4 TCP networking stack could allow an unauthenticated remote attacker to trigger memory corruption, crash vulnerable systems, and potentially execute arbitrary code withOpenShiftOpenShift and layered products that depend on affected RHEL kernels also require attention.Red Hat Enterprise LinuxRed Hat confirms that systems with ordinary IPv4 TCP networking remain vulnerable even when MPTCP is disabled, including default Red Hat Enterprise Linux configurations.UbuntuUbuntu likewise rates the vulnerability Critical at 9.8.