Linux TCP Flaw Rated 9.8 Affects Major Distributions

A flaw tracked as CVE-2026-98432 in the Linux kernel's TCP code affects Ubuntu, Red Hat Enterprise Linux, and other distributions. The bug is a race condition in the code that sets up new IPv4 TCP connections, allowing the kernel to read memory it has already freed. This use-after-free vulnerability enables an attacker to run commands as root on Linux servers with a multipath TCP listener. The Linux kernel's own CVE team rates the flaw 9.8 out of 10 on the CVSS scale, a score added to the record on October 24.

Anthropic reported on October 27 that its AI model, Claude, wrote an exploit using the flaw. In the test, leaking a kernel address took 48 minutes, and reaching command execution took five more minutes. The kernel fix credits Anthropic researcher Xinyang Ge with reporting the bug. The bug was introduced in Linux 4.4, and kernel developers applied a fix on October 5. The fix is available in specific kernel versions, including 5.10.272, 5.15.223, and 6.1.190.

As of October 29, Ubuntu and Red Hat had not released a fixed kernel for this flaw. Red Hat says its fixes are currently deferred to a future update with no release date given. Red Hat, Amazon, Oracle, and SUSE score the flaw between 5.9 and 8.1, lower than the kernel team's rating. Debian, Oracle Linux, SUSE, and Amazon Linux have shipped fixed packages for some of their kernels. No vendor advisories or Anthropic's post reported attacks using the flaw as of October 29.