Divergent CVSS scores split distros on Linux TCP use-after-free CVE-2026-98432
Anthropic says its AI wrote a working root exploit for the bug; Red Hat and Ubuntu still have no fixed kernel and rate it far below the kernel team's 9.8.
What to know
- CVE-2026-98432 is a use-after-free race in Linux's IPv4 TCP handshake code, scored 9.8 by the kernel's own CVE team but only 5.9–8.1 by Red Hat, Amazon, Oracle and SUSE.
- Anthropic says its AI model wrote a working exploit achieving unauthenticated remote root on Linux servers running an MPTCP listener, in a controlled lab test.
- As of October 30, Ubuntu and Red Hat have not shipped a fixed kernel package, while Debian, Oracle Linux, SUSE and Amazon Linux have patched at least some kernels.
- Go 1.24+ enables MPTCP by default on listening sockets, which the Go Security Team flagged as relevant to exposure since the public exploit specifically targeted MPTCP.
The dispute Whether Anthropic's lab-demonstrated root RCE on MPTCP servers reflects real-world risk severity, or whether vendors like Red Hat are correctly downgrading it because the race condition is hard to win in practice. · positions read across 60 posts and comments
The wildly inconsistent vendor severity scores for the same bug are confusing and suspicious.
-
“It's so weird that every distro rates the criticality so wildly differently. ... Anthropic says they had root RCE, Redhat says that RCE is only a theoretical risk. So which one is it?”
tom-dixon · Reddit ↗
The involvement of an AI-written exploit shouldn't by itself change how a vulnerability is scored.
-
“If the existence of AI makes every vulnerability more severe, and that means they need to be weighed higher, then every vulnerability would be weighed higher, with a net result of exactly nothing.”
carsncode · Reddit ↗
The whole episode is being treated with weary sarcasm as just another month's headline bug.
-
“Only a couple of days left till the end of the cybersecurity awareness month. Quick! Let's cram up a few more "facepalm" hacks.”
bontchev · Mastodon ↗
“currently deferred to a future update”
Red Hat, Linux vendor · The Hacker News ↗ · Oct 28
Anthropic AI research lab, bug reporterXinyang Ge Anthropic researcherRed Hat Linux distribution vendor (RHEL)Canonical / Ubuntu Linux distribution vendorGo Security Team Google's Go language security team
How it unfolded 1 development · click the chart to see its coverage articlespostscomments
-
background
Researchers publish guidance on reconciling the conflicting scores — A security research write-up argues the upstream 9.8 score, vendor distribution scores, and Anthropic's lab exploit each describe a different scope and should not be substituted for one another, and urges immediate patch validation on MPTCP-exposed Linux hosts.
-
background
Red Hat and Ubuntu still have no fixed kernel package — By October 30, Red Hat's advisory status for RHEL 8, 9 and 10 and OpenShift 4 changes from 'Fix deferred' to 'Affected,' with no release date given; Ubuntu also has not shipped a fix, while Debian, Oracle Linux, SUSE and Amazon Linux have patched at least some kernels.
-
1
Distributions publish sharply divergent severity ratings
Red Hat, Amazon, Oracle and SUSE score the flaw between 5.9 and 8.1, well below the kernel team's 9.8; Ubuntu's page shows the 9.8 score but lists cloud, FIPS and real-time kernels as still vulnerable or work-in-progress; Red Hat says its fix is 'currently deferred to a future update.' The Go Security Team separately notes that, since Go 1.24, Go programs request MPTCP by default on listening sockets.
“no confidentiality or integrity impact has been demonstrated…”
— Red Hat -
first by Mastodon, 8d ago · also The Hacker News
-
M
Update on the 9.8 CVSS TCP/IP RCE in the Linux kernel (CVE-2026-98432): we've detected what appears to be a threat actor activity scanning the entire internet for exposed affected systems. Our own scanning also suggests that the number of potential targets is high, therefore there is an increased likelihood of threat actors attempting to develop…
2 more of the top 3 · 60 posts in this stretch
-
Mentioned it before already, but RE: CVE-2026-98432, here was the first #grsecurity patch for Linux 5.6 when MPTCP was first introduced:
-
Here's the NIST link: https://nvd.nist.gov/vuln/detail/cve-2026-98432Here are my notes so far after digging into this with Claude + defensive access:1. Not just an MPTCP thing - any received IPv4 packet with options creates the problematic conditions.2. Also appears that using NetLabel/CIPSO (SELinux or Smack with a CIPSOV4 mapping) creates the…
-
-
background
Anthropic discloses AI-written root exploit for the bug — Anthropic says its AI model wrote an exploit using the flaw to let a remote attacker with no credentials run commands as root on Linux servers with a multipath TCP (MPTCP) listener, in a controlled lab setting.
-
background
Kernel CVE team scores the flaw 9.8 on CVSS — Nine days after publishing the CVE, the kernel's own CVE team adds a 9.8 score, assuming an attacker who sends a crafted TCP request carrying IPv4 Record Route or Timestamp options and resends it to win the race, rating attack complexity low.
-
background
Linux kernel CVE team publishes CVE-2026-98432 — The flaw, a race condition in IPv4 TCP request-socket handling that frees IP options still referenced by another CPU, is assigned a CVE identifier; IPv6 is unaffected because its kernel path duplicates options.
-
background
Kernel developers patch the TCP use-after-free upstream — A fix using kfree_rcu() instead of plain kfree() in inet_sock_destruct() and tcp_v4_reqsk_destructor() is applied upstream and backported to maintained stable kernel branches, ten days before the CVE is published.
Also covered reported alongside — the timeline has no entry for these yet
-
first by Rescana, 10d ago · also HN Frontpage, HN Best
2 more headlines
- CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation HN Frontpage · 9d ago
- TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 HN Best · 7d ago
What people are saying 21 voices from 4 sites · best of 60 · verbatim
- Did Anthropic give vendors only a description of the bug, or the actual working exploit?
- Why do Red Hat, Ubuntu and the upstream kernel team disagree so much on exploitability given the same underlying flaw?
- Nov 3
-
A
If you missed these releases yesterday: Red Hat: CRITICAL: RHSB-2026-016 Use-after-free - kernel IPv4 (CVE-2026-98432) https:// access.redhat.com/security/vul nerabilities/RHSB-2026-016 Canonical: Fixes available in -proposed pocket for CVE-2026-98432 https:// ubuntu.com/blog/fixes-availabl e-in-proposed-pocket-for-cve-2026-98432 More: The Hacker…
-
T
Ubuntu continues to work on the the fix for CVE-2026-98432. a critical use-after-free vulnerability in the Linux kernel's IPv4 TCP connection handling code (CVSS 9.8 score) Debian released the fix on Oct 16. https:// ubuntu.com/blog/fixes-availabl e-in-proposed-pocket-for-cve-2026-98432 # Security
- Nov 2
-
P
Critical UEFI Firmware Vulnerability Exposes Server Infrastructure to Remote Code Execution CVE-2026-97631 #Cybersecurity #UEFI #FirmwareSecurity #VulnerabilityManagement #ZeroTrust #InfrastructureSecurity #CVE202697631 #EnterpriseSecurity Source:
- Nov 1
-
Linux noob: I run a small VPS for a low stakes side project that runs Caddy and a Go backend that I've shutdown for precaution. Once a Ubuntu patch is made available, I read that applying the patch and reboot will be enough, but how can that be the case if someone used the exploit to break in and leave a rootkit or something like that? What are…
-
T
Linux kernel CVE-2026-98432 is a use-after-free in the IPv4 TCP handshake that a remote, unauthenticated peer can reach. Upstream is fixed, but Ubuntu's tracker still lists its kernels as vulnerable and Red Hat lists RHEL 8, 9 and 10 as affected. Anthropic says Claude built a root exploit for servers with a multipath TCP listener, which Go 1.24+…
- Oct 31
-
Fixed upstream in:[1]7.3 (2026-10-18)7.2.10 (2026-10-11)6.18.56 (2026-10-11)6.12.113 (2026-10-15)6.6.159 (2026-10-15)6.1.190 (2026-10-15)5.15.225 (2026-10-15)[1] https://lore.kernel.org/all/?q=tcp_v4_reqsk_destructor -- check for "kfree_rcu" being used instead of "kfree" within "tcp_v4_reqsk_destructor" (net/ipv4/tcp_ipv4.c)
-
Quite, however it looks quite rare:"Why it's urgent: the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection. Anthropic, whose researcher reported it, says its Claude model wrote a working proof-of-concept exploit that runs commands as root on "Linux servers with a multipath…
-
And it takes around an hour to do this in lab setting locally:> An enabling property of this race condition is that a lost race only fails the handshake without crashing the whole system, so a determined attacker can retry indefinitely until they succeed. In our proof of concept, it takes 48 minutes to leak a kernel pointer and another five…
-
Some notes I've got about this:- MPTCP is not a requirement, it is a generic use-after-free.- Exploitability over the internet is unlikely, most ISP routers drop packets with IP options fields.- At least according to Red Hat, dropping packets with IP options yourself helps, but is not a full mitigation.- Successful exploit requires multiple CPU…
-
At least if you’re on Amazon Web Services behind a load balancer you probably aren’t really that impacted enough to spend Halloween patching.> AWS Web Application Firewall, Application Load Balancer, Classic Load Balancer, TLS Listeners on Network Load Balancer, Cloud Front, API Gateway> Customers using the above services do not receive TCP…
-
>the kernel handed those saved options from the request socket to the new connection without copying them, then freed them immediately when the connection went away, while another CPU could still be reading them to build a handshake reply.If this requires a multi-core system to exploit, it's good news for most of the consumer routers that will…
-
T
Canonical's LXD and MicroCloud had a critical authentication bypass (CVE-2026-112816, CVSS 10.0). An attacker who can reach the HTTPS API and has a trusted client's public certificate can authenticate as that client by placing it in the certificate chain. Canonical says the result can be root on the host, depending on the victim's privileges…
- Oct 30
-
A
⚠️ Linux kernel vulnerability CVE-2026-98432 is a use-after-free in the code that sets up incoming IPv4 TCP connections. AlmaLinux 8, 9, and 10 are affected. Patched kernels are available for testing! https:// almalinux.org/blog/2026-10-30- cve-2026-98432/
-
B
Linux Kernel TCP Flaw Allows Remote Root Access A critical race condition in the Linux kernel TCP stack (CVE-2026-98432) allows remote attackers to gain root access. **If you run Linux servers (Ubuntu, RHEL, SUSE, Amazon Linux 2 and others), install your vendor's fixed kernel as soon as it's out and reboot. Updating containers alone won't help…
-
B
Only a couple of days left till the end of the cybersecurity awareness month. Quick! Let's cram up a few more "facepalm" hacks. "Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions": https:// thehackernews.com/2026/10/linu x-kernel-tcp-flaw-with-98-cvss.html
-
The overlaid HTML popup on that page for "Try The World's First Agentic AI Hacker." tool is cancerous and annoying. This should really be a link to a more reputable link for the CVE in question.It doesn't appear until you've read the page for maybe 10-15 seconds, so if you're not seeing it, just wait.It even managed to get past ublock origin…
-
O
「LinuxカーネルのTCP脆弱性（CVSSスコア9.8）がUbuntu、Red Hat、その他のディストリビューションに影響 」： # TheHackerNews 「LinuxカーネルのTCPコードに存在する脆弱性（ CVE-2026-98432） は、Ubuntu、Red Hat Enterprise Linux（RHEL）、およびその他のLinuxディストリビューションに影響を与えます。カーネルのCVEチームは、CVSSスコアで10点満点中9.8点と評価しています。 Anthropic社は…
- Oct 29
-
well, I dunno why they classified it the way they did I guess. I was just pondering.
-
That logic doesn't really check out. If the existence of AI makes every vulnerability more severe, and that means they need to be weighed higher, then every vulnerability would be weighed higher, with a net result of exactly nothing.
-
I wonder if Anthropic gave the distros only a description of the bugs and left it up to them to figure out how to exploit it, or actually gave them the exploit they had. It's so weird that every distro rates the criticality so wildly differently. It seems that most distros couldn't figure out a reliable exploit. Anthropic says they had root RCE…
-
H
So ubuntu published a CVE rated 9.8.... 😱 https:// ubuntu.com/security/CVE-2026-9 8432 Is the internet off again? Or is that not as dramatic as a PHP vulnerability.... 🤔