Critical Linux TCP race leaves Ubuntu and RHEL without fixes

A critical flaw in Linux kernel TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux and other distributions. The Linux kernel CVE team assigned a CVSS score of 9.8 out of 10, while Ubuntu and RHEL had not released fixed kernels as of October 29.

Anthropic said on October 27 that its Claude model wrote an exploit which used the issue to execute commands as root remotely on Linux servers running a multipath TCP listener. The company said a test took 48 minutes to leak a kernel address and another five minutes to reach command execution, but did not publish exploit code, the tested kernel version or its configuration.

A race in IPv4 TCP connection handling

The vulnerability is a use-after-free race condition in code that creates new IPv4 TCP connections. During the TCP handshake, the kernel transfers IP options from a pending request to a new socket without copying them. If the socket is destroyed while another CPU still uses those options to answer a retransmitted connection request, the kernel can read memory that has already been freed.

Linux developers fixed the issue on October 5, ten days before the CVE was published. The change waits for other CPUs to finish reading the options before freeing them. IPv6 is not affected because the kernel copies options for IPv6 connections. The flaw was introduced in Linux 4.4.

The exposure also sits alongside container-to-host escalation concerns, as container-to-host privilege escalation risks illustrates the importance of separating workload-level access from host-level privileges. Anthropic linked its root exploit to multipath TCP, or MPTCP, which applications must specifically request when opening a socket on Linux; the CVE record and upstream fix do not mention MPTCP.

Vendor status and differing severity assessments

Debian, Oracle Linux, SUSE and some Amazon Linux packages have shipped fixes. Debian issued updates for trixie and Debian 12, while Oracle Linux released fixes for UEK kernels. Amazon Linux 2023 has updates for kernel6.18 and kernel6.12 packages, although other Amazon kernel lines remained pending. Some SUSE products have fixes, while others were still in testing or had fixes in progress.

Ubuntu lists affected releases and several cloud, FIPS and real-time kernels as vulnerable or work in progress. RHEL 8, 9 and 10, plus OpenShift 4, had fixes deferred to a future update; RHEL 7 is not affected. Neither Ubuntu nor Red Hat supplied a release date.

Severity assessments differ because vendors judge the race harder to win. Red Hat’s CVE page scored it 5.9 and described a crash as the most likely result, while its updated advisory file listed an 8.1 score. Oracle and SUSE also used 8.1, and Amazon assigned 7.0. The kernel team rates attack complexity low because it considers both sides of the race attacker-induced.

Patch planning is the available response

There were no reported attacks using CVE-2026-98432 as of October 29, and the issue was not listed in the cited copy of CISA’s Known Exploited Vulnerabilities catalog. The advisories do not establish whether disabling MPTCP or blocking connection requests with IP options reduces risk.

Organizations should identify affected kernel packages and internet-reachable TCP services, then install vendor-provided fixed kernels where available. For self-built kernels, fixed versions include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. The kernel CVE team recommends updating to the latest stable kernel rather than cherry-picking individual fixes, so patch tracking should remain a priority for systems whose vendors have not yet released an update.