Linux Kernel TCP Flaw Rated 9.8 After Anthropic Demonstrates Root Exploit
A Linux kernel vulnerability identified as CVE-2026-98432 affects Ubuntu, Red Hat Enterprise Linux and other distributions, and was rated 9.8 out of 10 by the kernel’s CVE team. On October 27, Anthropic said its AI model had produced an exploit that could let a remote attacker without credentials run commands as root on Linux servers with a multipath TCP listener. As of October 29, no vendor advisory, the CVE record or Anthropic’s report described attacks exploiting the flaw.
The bug is a race condition in the setup of new IPv4 TCP connections. During the race, the kernel can access memory that has already been freed, a use-after-free condition. IPv6 is not affected by this specific race because the kernel copies the relevant connection options.
Exploitability depends on the environment
The kernel team’s severity assessment assumes an attacker can send TCP requests containing IPv4 Record Route or Timestamp options and repeatedly attempt the race. Anthropic’s reported root exploit used two stages: the flaw first disclosed a kernel address, helping bypass address randomization, and then enabled a callback pointer to be overwritten with attacker-controlled code. Anthropic said its test took 48 minutes to leak a kernel address and another 5 minutes to reach command execution.
The available evidence does not establish that every affected Linux server can be taken over in this way. Anthropic targeted a server with a multipath TCP listener, while Red Hat described the broader trigger as a remotely reachable exposed TCP service. Anthropic did not publish the exploit code, the kernel version or the tested configuration, and the advisories do not say whether disabling multipath TCP or blocking requests carrying IP options would reduce risk.
Patch availability differs by distribution
The upstream fix was backported to maintained stable kernel branches, but distribution users receive it through their vendor’s kernel packages. Debian, Oracle Linux, SUSE and Amazon Linux had shipped fixed packages for at least some kernels. Ubuntu and Red Hat Enterprise Linux had not released a fixed kernel as of October 29; Red Hat said its fixes were deferred to a future update, while Ubuntu listed several kernel variants as vulnerable or still in progress.
Organizations running a distribution with a fixed package should install that updated kernel. Administrators who build kernels themselves can update to Linux 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 or 7.3. The kernel CVE team recommends using the latest stable kernel and says individual fixes should not be cherry-picked. No supported mitigation was listed for systems whose vendors have not yet released a fix.