Critical Linux TCP Use-After-Free Flaw Linked to Reported Remote Root Exploit

A critical Linux kernel IPv4 TCP race condition, CVE-2026-98432, can trigger use-after-free during concurrent SYN processing and request-socket migration, potentially causing information disclosure, memory corruption, or system crashes. Anthropic reported that Claude developed an exploit achieving unauthenticated remote command execution as root against a server with a multipath TCP listener, but did not release exploit code or the tested kernel configuration. The Linux kernel CVE team assigned a CVSS score of 9.8; distribution vendors assigned lower scores, largely because of differing assessments of attack complexity. No attacks exploiting the vulnerability were reported.

The flaw allows shared IPv4 option structures to be freed while another CPU is still reading them under an RCU read lock. The fix defers memory reclamation until an RCU grace period has elapsed; a related IPv6 CALIPSO migration issue requires a separate patch. As of October 29, fixes were available for selected Debian, Oracle Linux, SUSE, and Amazon Linux kernels, while Ubuntu and RHEL had not released fixed packages. Organizations should prioritize affected-kernel inventory, track distribution-specific advisories, and deploy available fixes; no vendor-validated workaround was reported.