Linux kernel flaw could give attackers remote root access

SecurityOnline[.]info reports a Linux kernel flaw, CVE-2026-98432, described by the outlet as a severe privilege-escalation vulnerability that could enable unauthenticated remote code execution. The article states that, under specific network conditions, an attacker could achieve full root privileges without user interaction.

It notes that Anthropic researchers reportedly synthesised a working PoC exploit using the Claude AI model, illustrating a remote code-execution path via a use-after-free race condition in the kernel’s handling of Multipath TCP. The piece emphasises that there is no confirmed exploitation in the wild at present, but the vulnerability is rated CVSS 3.x 9.8 (Critical) and is associated with a broad impact across Linux kernel versions.

The publication details the fix process and practical response. Maintainers registered the defect on 15 October 2026, with corrective code upstream for stable branches, while distributions must package and distribute these patches themselves. The article cites the Ubuntu security tracker, which indicates Canonical engineers are actively preparing package updates, and it cautions that enterprise environments should monitor for pending updates and verify patch availability across kernel repositories.

It warns that the exposure affects long‑term support distributions, including Ubuntu releases spanning 16.04 to 26.10, and explains that weaponisation, though possible, requires a target running an active Multipath TCP listening service; many distributions disable MPTCP by default, reducing opportunistic exposure. Administrators are urged to apply kernel updates promptly once available and to follow vendor advisories for distribution-specific fixes.