Linux kernel TCP flaw CVE-2026-98432 hits CVSS 9.8 as Anthropic AI builds root exploit

A race condition in TCP connection setup

NVD published the record for CVE-2026-98432 on October 15, scoring it 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity and availability. According to dev.to, the flaw is a use-after-free in the kernel's IPv4 TCP connection handling.

The bug sits in how IP options are handled during the TCP three-way handshake. When a handshake completes, the kernel hands the options attached to the incoming request to the new socket — but it moves only a pointer, not a copy of the data. If a retransmitted SYN for the same request is processed on another CPU core at that moment, the core reads memory that has already been transferred and freed. The fix, written by Google's Eric Dumazet after a report from Anthropic's Xinyang Ge, is a two-line change swapping kfree() for kfree_rcu(), which defers the free until readers finish under the kernel's RCU mechanism. It was committed October 1 and merged October 5. Every kernel since 4.4, released in 2016, is affected; the equivalent IPv6 path copies the options, so only IPv4 is exposed.

An AI-built exploit chain

On October 27, Anthropic published results from pointing an unreleased internal research model at major software, with this flaw among five demonstrations alongside targets in Chrome, Safari, the Android lock screen and Windows. As dev.to reports, the model independently built an exploit from a single prompt, achieving unauthenticated root command execution without user interaction on a Linux server running an MPTCP listener.

The chain has two stages. The first uses the race to defeat KASLR: by making the kernel honor an attacker-controlled length field, more bytes than intended are copied back, and any kernel pointers in the response reveal the memory layout. That took 48 minutes. The second reuses the same use-after-free to overflow a buffer and overwrite a callback pointer, so the kernel jumps to attacker-planted code and runs a shell command as root — five more minutes, 53 in total. Losing the race merely fails one handshake without crashing the host, so an attacker can retry until it succeeds. Anthropic has not released the exploit code, the kernel version tested or its environment configuration, and reported the issue under coordinated disclosure allowing 90 days for fixes plus 45 more before publication.

MPTCP listeners you didn't enable

The root-level demonstration required an MPTCP listener, and the same attack has not been shown against servers without one. That is thin comfort: since Go 1.24, TCP listeners enable MPTCP by default when the kernel supports it, so services written in Go may quietly become MPTCP endpoints. In an October 29 statement cited by dev.to, the Go Security Team described disabling it with GODEBUG=multipathtcp=0 at runtime or a godebug directive in go.mod, though code calling SetMultipathTCP overrides both. The team called per-program disabling a fragile mitigation — one remaining MPTCP listener reopens the door, and the bug is not specific to MPTCP anyway. Similar exposure arises when net.ipv4.tcp_migrate_req is enabled or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is used.

Uneven patch availability

The fix is merged upstream and backported to maintained stable branches, but distro delivery varies. Debian shipped 6.1.190-1 for Bookworm and 6.12.113-1 for Trixie. Ubuntu had no fix as of October 30, with 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 listed as vulnerable and fixes in progress. Red Hat's rating climbed from an initial 5.9 (Moderate) — with its machine-readable advisory showing 8.1 and its bug tracker moving from medium to high on October 29 — to Critical in bulletin RHSB-2026-016 on October 30, and its CVE page now shows 9.8. RHEL 8, 9 and 10 plus OpenShift Container Platform are affected, while RHEL 7 lacks the vulnerable code. CIQ confirmed impacts on Rocky Linux 8, 9 and 10 and shared an interim firewall rule. Oracle Linux, Amazon Linux and SUSE have shipped fixes for some affected kernel versions.

Interim defenses

For systems still awaiting packages, Red Hat's bulletin provides an nftables rule that drops incoming IPv4 TCP packets whose IP header length exceeds the standard five words — meaning IP options are present — before they reach the vulnerable code path.

Why it matters

Two things lift this above a routine critical CVE. First, the exposure is unusually broad: any IPv4 TCP listener on a kernel from the last decade is in scope, and default-on MPTCP in Go means many operators are exposed without realizing it. Second, the exploit itself is the signal: an AI model went from a single prompt to a working, KASLR-bypassing, root-granting remote exploit in under an hour. If exploit development is now automatable rather than just bug discovery, defenders should assume every kernel flaw of this severity comes with a working exploit — and patch, or filter IP options, accordingly.