Linux TCP flaw rated 9.8 puts Ubuntu and Red Hat at risk

A Linux kernel TCP flaw, tracked as CVE-2026-98432, has been disclosed as a high-severity vulnerability affecting Linux distributions including Ubuntu and Red Hat Enterprise Linux (RHEL). The kernel’s own CVE team rates the issue at 9.8 out of 10 on the CVSS scale. The bug is a race condition during the TCP handshake that can cause use-after-free when the kernel reuses IP options tied to a pending connection.

In practice, a remote attacker could exploit the race to read freed memory or cause memory corruption, potentially leading to a crash or other impact. IPv6 connections are not affected because IPv6 path handling differs. The flaw was introduced in Linux 4.4, with a fix committed upstream on 5 October, and the patch makes the kernel wait for other CPUs to finish reading the options before freeing them.

Anthropic has claimed that its AI model Claude discovered and wrote an exploit for this vulnerability, enabling a remote attacker with no credentials to run commands as root on Linux servers with a multipath TCP listener. The link between multipath TCP (MPTCP) and the bug comes from Anthropic’s post, though the kernel fix itself and CVE records do not state MPTCP as part of the vulnerability. The upstream fix credits Anthropic researcher Xinyang Ge.

As of 29 October, Ubuntu and RHEL had not released fixed kernels, while several other vendors (Amazon, Oracle, SUSE, Debian, etc.) had, or were providing mitigations. Vendor advisories vary, with Red Hat rating the issue as Moderate to Important (scores 5.9 to 8.1) and noting delays in fixed updates.