Linux kernel TCP flaw rated 9.8 leaves Ubuntu and RHEL servers unpatched
Servers running multipath TCP listeners face the highest risk until distributions ship kernel fixes for the flaw.
A Linux kernel flaw tracked as CVE-2026-98432 is a use-after-free in the IPv4 TCP handshake code that the kernel CVE team scores 9.8, while Red Hat rates it 5.9 and later 8.1. Anthropic said on October 27 that its AI model built an exploit that, on servers running a multipath TCP listener, let an unauthenticated remote attacker run commands as root after bypassing KASLR, taking about 53 minutes. The bug dates to Linux 4.4 and was fixed upstream on October 5, but as of October 29 Ubuntu and RHEL had not shipped kernel fixes, while Debian, Oracle Linux, SUSE and Amazon Linux had shipped fixes for some kernels. Administrators on unpatched systems are advised to limit exposure, and CIQ suggests temporarily blocking IPv4 TCP packets carrying IP options, since disabling MPTCP alone does not remove the exposure. No exploitation in the wild has been confirmed.
Why it matters
Administrators of Ubuntu and RHEL systems are exposed while those distributions have not yet released a fixed kernel, even though the upstream fix has been available since October 5. Anthropic's demonstration that its AI model could build a working root exploit in about 53 minutes shows how quickly such bugs can be turned into attacks, which raises the cost of delay. Red Hat's lower score reflects that exploiting the race is hard and that it most likely causes a crash, so the gap between the two ratings is the key uncertainty for anyone deciding how urgently to act.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.