October 30, 2026 · 7 min read
CVE-2026-98432: a 9.8-rated Linux kernel TCP bug, a root exploit, and no Ubuntu or Red Hat kernel yet
A race in the Linux kernel's IPv4 TCP code can free memory that is still in use. Anthropic's red team showed it could give an unauthenticated attacker root on a server with an MPTCP listener. Debian, SUSE, Oracle and Amazon have fixes; Ubuntu and RHEL did not as of October 30. What is known, what is disputed, and what to do.