CVE-2026-98432: Linux TCP Flaw Scores CVSS 9.8

A critical use-after-free in Linux's IPv4 TCP handshake lets remote attackers run code as root. Upstream patched it on Oct 15, but Ubuntu and RHEL still ship vulnerable kernels.

Unboxing TN31 October 20262 min read

Linux server terminal showing a critical kernel vulnerability alert for CVE-2026-98432 — Image: atlasum.net

A critical use-after-free vulnerability in the Linux kernel's IPv4 TCP handshake, tracked as CVE-2026-98432, carries a CVSS 9.8 severity rating and can be triggered remotely by an unauthenticated peer. The Linux kernel CNA published the score, and upstream stable releases fixed the flaw on October 11 and 15, 2026. The bug dates back to Linux 4.4.

The problem sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the traffic. Anthropic, whose researcher reported the bug, says its Claude model produced a working proof-of-concept exploit that runs commands as root on Linux servers with a multipath TCP listener, without credentials. As of October 29, Ubuntu and Red Hat had not shipped fixed kernels.

Fixed Linux kernel versions

The upstream fix, a four-line change in the handshake path, landed in these stable releases. Systems running older kernels on the 4.4 through 7.2 lines remain exposed until they move to a patched build or apply a distribution fix.

5.10.272
5.15.223
6.1.190
6.6.159
6.12.113
6.18.56

Test yourself

Test yourself: Real or Fake?

Ten headlines — some from our newsroom, some invented. Can you spot the fakes?

2 min

Play Real or Fake?

Keep your streak

Start a streak today

Today's quests reset at midnight. Finish all three to open the chest.

0 of 3 done

Your profile

Ubuntu and RHEL still vulnerable

Most servers run a distribution kernel rather than a mainline build, and the gap between upstream and enterprise distros is where the risk lives. Ubuntu's CVE tracker still lists its kernel as Vulnerable on every supported release. Red Hat marks RHEL 8, 9 and 10 as affected with no fix available at the time of writing.

Debian and current SUSE Enterprise kernels have a fix. Administrators should check their distribution's tracker, install the fixed kernel and reboot. Dropping TCP packets that carry IPv4 options is an interim mitigation, and hosts with multipath TCP listeners should be patched first.

What it means for you

If you run Linux servers, this is not a wait-and-see situation. The flaw is reachable from the network before authentication, and a public proof-of-concept exists. Until your distribution ships a fixed kernel, the safest temporary step is to filter TCP packets carrying IPv4 options at the edge.

For Tunisian businesses and hosting providers, the practical move is to audit which kernels are in production, prioritize any machine with a multipath TCP listener, and schedule a reboot once a distro patch arrives. No timeline has been announced for Ubuntu or RHEL fixes, so track their security advisories closely.