started · updated
Linux kernel vulnerability CVE-2026-98432 allows remote root access
A critical vulnerability in the Linux kernel, identified as CVE-2026-98432, has been disclosed, carrying a severity score of 9.8 out of 10. The flaw involves a use-after-free (UAF) error within the IPv4 TCP communication processing, where the system references memory that has already been released during TCP connection handling.
On October 27, 2026, Anthropic demonstrated a successful exploit using AI-generated code. The attack targeted servers listening for Multipath TCP (MPTCP) and allowed for the remote execution of commands with root privileges without requiring authentication or user interaction.
While the CVE team announced the issue on October 15 and patches have been integrated into stable kernel versions, various distributions are at different stages of remediation. For instance, Amazon Linux 2023 has released updates for kernel 6.18 and 6.12, while some Ubuntu versions were reported as still being in the process of being patched as of late October. Administrators are advised to check their specific Linux distributions and apply necessary updates or mitigation measures, such as blocking TCP packets with IP options via firewalls.
Entities
Amazon Linux · Anthropic · Calil · Linux · Linux kernel · Ubuntu
Claims
What the coverage asserts, and how many sources carry each claim.
- [○ 1 SOURCE] Amazon Linux 2023 has released security updates for kernel 6.18 and 6.12. dev.classmethod.jp
- [● 3 SOURCES] The Anthropic exploit targeted servers using Multipath TCP (MPTCP). ascii.jp · dev.classmethod.jp · weekly.ascii.jp
- [● 4 SOURCES] The Linux kernel vulnerability CVE-2026-98432 has a CVSS severity score of 9.8. ascii.jp · blog.calil.jp · dev.classmethod.jp · weekly.ascii.jp
- [● 4 SOURCES] The CVE team publicly disclosed the vulnerability on October 15, 2026. ascii.jp · blog.calil.jp · dev.classmethod.jp · weekly.ascii.jp
- [● 4 SOURCES] Anthropic demonstrated an exploit that achieves remote root command execution without authentication. ascii.jp · blog.calil.jp · dev.classmethod.jp · weekly.ascii.jp
- [○ 1 SOURCE] As of October 30, no worldwide attacks exploiting this vulnerability have been reported. blog.calil.jp
- [● 3 SOURCES] The vulnerability is a use-after-free (UAF) flaw in the IPv4 TCP communication processing. ascii.jp · dev.classmethod.jp · weekly.ascii.jp
- [○ 1 SOURCE] Blocking IP options in TCP packets can serve as a mitigation measure. blog.calil.jp