Overview
- CVE-2026-98432 is a use-after-free race in the IPv4 TCP handshake that affects Linux kernels from 4.4 onward and can leak memory, crash systems, or under specific conditions enable remote code execution.
- Anthropic reported on Tuesday that its Claude model wrote an exploit that first leaks a kernel address to defeat KASLR and then overwrites a callback pointer to run commands as root on servers running a Multipath TCP (MPTCP) listener.
- The Linux kernel project applied an upstream fix on October 5 and the kernel CVE team later assigned a 9.8 score, but vendors differ on severity and some distributions have not yet shipped patched kernel packages.
- Amazon and several vendors have released patched kernels or updated images and advise updating the kernel and rebooting as the definitive remediation, while interim steps include disabling MPTCP and blocking IPv4 TCP packets with IP options.
- There are no confirmed in-the-wild exploit reports so far, but the Anthropic demonstration and Go 1.24 enabling MPTCP by default raise urgent operational risk for admins who run publicly reachable IPv4 TCP listeners.