CVE-2026-98432: Linux Fixes TCP Use-After-Free, Ubuntu and RHEL Still Vulnerable

⏱️ Reading time: 9 min

A remote attacker, without a username or password, can read kernel memory, corrupt it, or crash the server by simply sending it TCP connection packets: that’s how the Linux kernel’s own numbering authority describes CVE-2026-98432, the critical Linux flaw it fixed this month with a four-line patch.

📑 En este artículo

1. TL;DR
2. What the Critical Linux Flaw Is
3. What Happened
4. Context and History
5. Technical Details: Why the Exploit Works
6. Impact and Analysis
7. What’s Next
8. Frequently Asked Questions
   1. What is CVE-2026-98432?
   2. Which Linux versions fix the kernel security flaw?
   3. Does the Linux kernel vulnerability affect containers?
   4. What is Multipath TCP and why does it widen the risk?
   5. How can you mitigate the TCP use-after-free if there’s no fixed kernel yet?
   6. Did Claude write a working exploit for this critical Linux flaw?
9. References

The bug has existed since version 4.4, released in 2016, in the code that processes the TCP handshake over IPv4. Red Hat upgraded its rating to Critical on October 30, Ubuntu still marks its kernels as vulnerable, and Anthropic says its Claude model wrote an exploit that grants remote root access without needing any credentials.

TL;DR

• CVE-2026-98432: a critical use-after-free (CVSS 9.8) in Linux TCP, exploitable without credentials.
• Anthropic reported the bug and says Claude wrote a working root exploit for servers with multipath TCP.
• Red Hat upgraded the rating to Critical on October 30 and lists RHEL 8, 9, and 10 as still unpatched.
• Ubuntu marks the flaw as vulnerable across all its versions as of October 31, 2026, with no patch released.
• The Go security team warns that Go programs open multipath TCP listeners by default, widening the risk.

What the Critical Linux Flaw Is

CVE-2026-98432 is the critical Linux flaw that fixes a use-after-free in the IPv4 code that processes the TCP handshake. The kernel frees the memory holding a connection request’s IP options, and due to a race condition, another code path can still read or write to it after it has been freed.

What Happened

The stable Linux kernel released the patch on October 11 and 15, 2026. The fixed versions are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. The record was published on cve.org on October 15, and the kernel’s numbering authority gave it a 9.8 out of 10 on CVSS 3.1: the maximum score for a flaw that requires no user interaction.

On October 30, Red Hat upgraded its own rating from Important (8.1) to Critical (9.8) and published a bulletin with a temporary mitigation. The next day, at 5:15 PM CDT on October 31, Ubuntu’s tracker still marked the linux package as “Vulnerable” across every supported version, with no security advisory published. Red Hat Enterprise Linux 8, 9, and 10, along with OpenShift Container Platform, show the same status: affected, with no patch available.

Not every distribution is behind. AlmaLinux has fixed kernels for its 8, 9, and 10 versions in its testing repository since October 30, a day ahead of Red Hat, the base it derives from. Amazon Linux has already fixed all of its kernels. Debian, SUSE Enterprise, and Oracle UEK also had patched versions available before Red Hat upgraded its rating.

Context and History

The Linux kernel vulnerability was reported by Xinyang Ge, a researcher at Anthropic. The commit that fixes it, titled “ipv4: free inet_opt and ireq_opt after an RCU grace period,” is signed by Eric Dumazet and was reviewed by Kuniyuki Iwashima, two of the kernel’s regular networking subsystem maintainers.

The kernel security flaw carries seven years of history: the first affected version is 4.4, and only the 4.4-to-5.4 branch falls outside its scope because it already reached upstream end of life and won’t receive an official patch from the Linux project; distributions that still maintain it have to backport the fix themselves. The actual change in the source code, as detailed by Atlas, spans just four lines: moving the memory release to after the RCU grace period, the mechanism the kernel uses to know when no one else is reading a structure before deleting it.

Technical Details: Why the Exploit Works

When a SYN packet arrives with IPv4 options (a route record, for example), the kernel creates a temporary “request socket” and stores those options in two pointers, inet_opt and ireq_opt. If the request expires or gets processed out of order, one code path frees that memory; if, almost simultaneously, another path is still completing the TCP handshake with the final ACK, it tries to read the memory the first path already freed.

sequenceDiagram
participant C as Remote attacker
participant K as Linux kernel
participant M as IPv4 options in memory
C->>K: sends SYN with IPv4 options
K->>M: allocates ireq_opt for the request
Note over K,M: the request timer expires
K->>M: frees ireq_opt after the RCU grace period
C->>K: sends the handshake's final ACK
K->>M: tries to read the already-freed ireq_opt
Note over C,M: use after free, kernel memory leak or corruption

That’s the classic use-after-free pattern: two execution paths that don’t coordinate on who owns a block of memory. According to the kernel’s own CNA scoring, the consequences range from exposing kernel heap contents to the remote peer, to corrupting memory or hanging the machine.

IPv6 isn’t affected by this particular issue: the commit message itself clarifies that, because that network stack doesn’t share the same IP options path. The attack window also doesn’t depend on any specific application, because the TCP handshake is processed inside the kernel before the connection ever reaches a user-space program.

Impact and Analysis

The Linux kernel vulnerability reaches any server, physical or virtual, running a kernel 4.4 or later without the patch, and that includes containers: a container shares the host’s kernel, so a new image changes nothing if the machine running it is still vulnerable.

What really widens the risk is Multipath TCP (MPTCP), the extension that allows combining several network paths into a single connection. The exploit Claude built needs, according to Anthropic, “Linux servers with a multipath TCP listener” and no credentials at all. The Go security team warns that programs written in that language open this type of listener by default, so the configuration the attack requires is more common than it first seemed: it doesn’t depend on an administrator having deliberately enabled it.

⚠️ Heads up: if your server runs a Go binary with a TCP listener, it probably has multipath TCP enabled without you having asked for it. Check it before assuming the attack doesn’t apply to you.

The episode also leaves an uncomfortable data point about the state of artificial intelligence in security: the same critical Linux flaw a human researcher reported ended up with a proof of concept written by a model, capable of turning a remote bug into root access with no username or password. Anthropic didn’t publish the exploit, but the fact that a model can reach that result changes the calculus of how much time passes between a bug becoming known and someone turning it into a weapon.

What’s Next

The first step is checking your own distribution’s tracker, because version numbers don’t match between the upstream kernel and the one each distribution packages. To confirm whether your kernel already has the patch, run uname -r and compare it against the table of fixed versions: a result like 6.12.113-generic already includes the fix if the number matches or comes after the one listed above. On Ubuntu Pro, the command pro fix CVE-2026-98432 --dry-run tells you directly whether the installed package is still exposed.

While the patch arrives, Red Hat proposes an nftables mitigation in its RHSB-2026-016 bulletin, and Atlas suggests a provisional rule: dropping TCP packets that carry IPv4 options. Both options also cut off legitimate traffic that uses those options, so it’s best to apply them only until the definitive kernel arrives. If you don’t use multipath TCP, disabling it reduces the attack surface without touching the rest of your traffic; if you do use it, prioritize patching those hosts first.

Try it yourself: check your kernel’s status against your distribution’s tracker, and if you’re running Ubuntu or RHEL, apply the nftables rule from Red Hat’s bulletin now while you wait for the definitive patch.

Frequently Asked Questions

What is CVE-2026-98432?

It’s the identifier for the CVE-2026-98432 bug, a use-after-free in the Linux kernel’s IPv4 code that a remote, unauthenticated attacker can exploit during the TCP handshake.

Which Linux versions fix the kernel security flaw?

The fixed stable branches are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. Versions between 4.4 and 5.4 reached upstream end of life and don’t receive an official patch from the Linux project.

Does the Linux kernel vulnerability affect containers?

Yes, because a container uses the host’s kernel. If that kernel doesn’t have the patch, no change inside the container image avoids the problem.

What is Multipath TCP and why does it widen the risk?

Multipath TCP (MPTCP) is a TCP extension that combines several network paths into a single connection. The exploit Claude built needs a server with an active multipath TCP listener, and Go programs open this type of listener by default.

How can you mitigate the TCP use-after-free if there’s no fixed kernel yet?

Red Hat recommends an nftables rule in its RHSB-2026-016 bulletin, and Atlas proposes dropping TCP packets with IPv4 options in the meantime. Disabling multipath TCP, if you don’t use it, also reduces exposure.

Did Claude write a working exploit for this critical Linux flaw?

According to Anthropic, yes: its model built a proof of concept that executes commands as root on servers with a multipath TCP listener, without needing any credentials. The company didn’t publish the exploit code.

References

• Atlas: live coverage and tracking of patch status by distribution for CVE-2026-98432.
• National Vulnerability Database: official record of the vulnerability with its CVSS score.
• CVE.org: public record of the CVE-2026-98432 identifier assigned by the Linux kernel’s CNA.
• Red Hat: CVE tracking page with the Critical rating and the RHSB-2026-016 mitigation bulletin.
• Ubuntu Security: status tracker for the linux package by supported version.

📱 Do you like this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.

Featured image: Foto de Xavier Cee en Unsplash