TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8

Remote attackers can now exploit a critical vulnerability in Linux TCP handshakes to gain root access on vulnerable servers.

On October 15, 2026, a critical remote use-after-free vulnerability, CVE-2026-98432, was fixed upstream in the Linux kernel's IPv4 TCP handshake. This vulnerability, with a CVSS score of 9.8, can be exploited by an unauthenticated remote peer. Anthropic's researcher discovered the bug, and their Claude model generated a proof-of-concept exploit that could grant root access on specific Linux servers. The vulnerability affects Linux kernels from version 4.4 onwards, impacting the security of web servers, SSH, databases, and other network-facing services. While upstream fixes were released in mid-October, several major Linux distributions, including Ubuntu and Red Hat Enterprise Linux (RHEL), had not yet released patches as of October 29, 2026, leaving many systems vulnerable. Mitigation strategies include dropping TCP packets with IPv4 options or patching multipath TCP listeners.

The delayed patching by major Linux distributions like Ubuntu and RHEL highlights a common challenge in the enterprise software ecosystem: the gap between upstream fixes and widespread deployment. This situation forces system administrators to rely on interim workarounds or to manually track and apply patches, increasing operational overhead and risk. The differing severity ratings across various vendors—from the kernel CNA's Critical (9.8) to Red Hat's Important (8.1)—also create confusion for security teams prioritizing remediation efforts.

The fact that a proof-of-concept exploit was generated by an AI model like Claude, and specifically targets servers with multipath TCP listeners, signals a growing trend in sophisticated exploit development. This raises concerns about the potential for automated or AI-assisted attacks against network infrastructure. The vulnerability's presence in the core TCP handshake means that its impact is broad, affecting virtually any Linux server that accepts network connections, regardless of the application layer.