Linux kernel flaw CVE-2026-98432: what it is, who is exposed and what to do
A critical use-after-free in the Linux kernel's TCP code is rated 9.8 out of 10. Which systems are exposed, where patches stand and what administrators can do.
The essentials: CVE-2026-98432 is a memory-safety bug in the part of the Linux kernel that handles incoming IPv4 TCP connections. An attacker can reach it over the network without logging in, and the kernel’s security team, Red Hat and Ubuntu all score it 9.8 out of 10. Fixes are out for Debian and several SUSE releases, while Ubuntu’s page still listed work in progress on its last update, October 30, 2026. Security firm Rescana says no vendor, CERT or the kernel team has reported attacks in the wild.
What is the bug?
It is a race condition that leads to a “use-after-free”. When a Linux server sets up a TCP connection, the kernel keeps a small record of the connection’s IP options. According to the kernel description published by Debian, Ubuntu and SUSE, a retransmitted connection request, or the migration of a pending request between sockets, can leave one processor freeing that record while another is still using it.
Using memory after it has been released can crash a machine or corrupt its memory. Red Hat says the issue “primarily results in a system crash leading to a Denial of Service (DoS) or potential memory corruption”.
The fix is short: it delays the release of that memory until nothing can still be reading it. The kernel commit is titled “ipv4: free inet_opt and ireq_opt after an RCU grace period”, and Debian’s tracker lists it as part of Linux 7.3-rc7.
How serious is it?
Vendors do not fully agree, mainly because the race is hard to win reliably.
| Scorer | CVSS 3.1 score | Rating |
|---|---|---|
| Linux kernel CNA | 9.8 | Critical |
| Red Hat | 9.8 | Critical |
| Ubuntu | 9.8 | Critical, priority High |
| SUSE | 8.1 | Important |
Sources: SUSE, Red Hat and Ubuntu pages, read on November 2, 2026. Rescana says Red Hat first scored the flaw lower, at 8.1, and that Oracle and Amazon also use 8.1.
Red Hat says reliable code execution “requires precise heap control”. But a working attack has been demonstrated in a lab. In a post dated October 27, 2026, the Frontier Red Team at the AI company Anthropic described work by its own model: “Claude wrote an exploit that allows a remote attacker to send packets to Linux servers with a multipath TCP listener to run arbitrary commands as root.” The company reported that its proof of concept took 48 minutes to leak a kernel pointer and five more minutes to reach shell command execution. Rescana notes that Anthropic has not published the exploit.
Who is exposed?
Rescana traces the bug to Linux 4.4 and says stable fixes landed in versions 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Distributions backport fixes to their own kernels, so an older version number on a patched system can be normal: the vendor’s advisory is what counts.
Red Hat lists Enterprise Linux 8, 9 and 10 and OpenShift, and warns that any product relying on the RHEL kernel may be affected.
Multipath TCP (MPTCP) has drawn attention because it was the setting of Anthropic’s demonstration. That does not mean other servers are safe. The Go Security Team warns: “the underlying bug is not specific to MPTCP. It is possible that systems with no MPTCP listeners are vulnerable.” It adds that since Go 1.24, Go programs turn on MPTCP by default for listening sockets on Linux, so some servers may have an MPTCP listener without their administrators having chosen one.
Where do patches stand?
| Distribution | Status | Source |
|---|---|---|
| Debian bookworm | Fixed in 6.1.190-1 | Debian tracker |
| Debian trixie | Fixed in 6.12.113-1 | Debian tracker |
| SUSE | Advisories dated October 29, including fixes for SLES 16.0 and SLES 15 SP5-LTSS | SUSE |
| Red Hat | Fixed kernels for RHEL 8, 9 and 10 on November 1; RHEL 9 real-time and OpenShift 4 still affected | Rescana |
| Ubuntu 22.04 to 26.10 | Work in progress | Ubuntu, updated October 30 |
| Ubuntu 16.04 to 20.04 | Listed as vulnerable | Ubuntu, updated October 30 |
This table will age quickly. Check your own distribution’s page before acting on it.
What should administrators do?
Patch first. Red Hat is blunt: “Applying kernel security updates as they become available is the only complete solution.” The Go team agrees that upgrading to a patched kernel is the best fix. Check your vendor’s notes on rebooting into the new kernel.
If you cannot patch yet, Red Hat’s bulletin gives an nftables rule that drops IPv4 TCP packets carrying IP options. It says that filtering can reduce exposure but “is not a substitute for patching”.
Reduce the demonstrated route. The Go team says that setting GODEBUG=multipathtcp=0 turns off the default in Go programs. A reply on the oss-security mailing list adds that sysctl -w net.mptcp.enabled=0 disables MPTCP system-wide. Neither removes the bug itself, and Rescana advises testing network filters before relying on them.
