What is CVE-2026-98432?
CVE-2026-98432 is a use-after-free bug in the Linux kernel's IPv4 TCP code. An attacker can reach it over the network with crafted packets, before any application sees the connection. The Linux kernel CVE team scored it 9.8, the top of the critical band. NVD records a network attack vector with low complexity, no privileges and no user interaction.
The flaw sits in how the kernel passes IP options from a pending connection request to the new child socket. tcp_v4_syn_recv_sock() hands over the option block without copying it. Another CPU can process a retransmitted SYN for the same request and build a SYNACK from those options. If the child socket is freed first, the second CPU reads memory that has already been released.
The packet-level trigger is narrow. The kernel reaches the bug through a TCP connection request that carries IPv4 options. Ordinary traffic almost never uses them. AlmaLinux still tells administrators to treat any host accepting IPv4 TCP from untrusted networks as exposed. The vulnerable code runs before an application accepts the connection.
The upstream fix, written by Eric Dumazet, frees those objects after an RCU grace period. The kernel advisory explains that child sockets lacked SOCK_RCU_FREE and released the options with a plain kfree(). Readers already used RCU, so the patch switches the free to kfree_rcu().
The bug goes back to Linux 4.4. It stems from a change that let request sockets be processed without holding the listener lock. CSO Online reports that eight kernel branches were affected. IPv6 is not affected by the main issue, although the advisory notes a related migration problem that a separate patch will address.
Red Hat rates the flaw critical for its enterprise kernel. Its analysts note that reliable code execution needs precise heap control. They still class it as critical because it requires no local access and can crash a host outright.
How did Claude turn a race condition into root?
Anthropic's Frontier Red Team published the exploit details on 27 October. The team used an unreleased internal research model, not a shipping Claude release. The post describes five attack chains against Chrome, Safari, Android, Windows and Linux. Each reportedly reached a serious impact with little or no user interaction.
The Linux chain has two stages. First, the exploit wins the race to make the kernel copy an attacker-controlled length and return extra bytes. That overread leaks a kernel pointer and defeats KASLR. Second, it reuses the same bug to overflow a buffer and overwrite a callback pointer. The callback jumps into a payload staged through an ordinary protocol feature, ending with a shell command running as root.
Anthropic says a lost race only fails the handshake, so an attacker can retry indefinitely. In the proof of concept, leaking the kernel address took 48 minutes and reaching command execution took about five more. The company reported the bug to the vendor and says it was patched upstream and backported to all maintained stable branches.
The disclosure followed Anthropic's coordinated policy. That policy gives vendors 90 days to patch. It allows a further 45 days before technical detail beyond a public advisory is published. The Linux bug was one of five. The Chrome work produced 62 CVEs, all patched as of Chrome 156, including 13 sandbox escapes.
The other chains follow the same pattern. On Safari, the model bypassed the same-origin policy and read history, cookies and session data. On Android, it pulled data from a locked Pixel 9 over USB. On Windows, it caused a remote crash through a QUIC flaw tracked as CVE-2026-33096. Anthropic estimated that several million listening servers were likely affected.
That autonomy claim is hard to audit from outside. Andrew Bolster, a senior R&D manager at Black Duck, told Dark Reading that the fixes are public and verifiable. He added that the report gives no success rates, cost or human-hours per chain, which he called critical context for security leaders.
Why are MPTCP listeners and Go servers the exposed surface?
Anthropic's Linux proof of concept targets a server with a Multipath TCP listener. MPTCP lets one connection use several network paths at once, for aggregation or failover. Linux implements it inside the networking stack, and applications normally have to ask for it.
MPTCP matters here because it can move request sockets between CPUs. A kernel clone of a request socket shares the same option block. The CVE description names this migration path as a second route to the same use-after-free. The tcp_migrate_req setting that enables it is off by default on AlmaLinux.
Kernel support and application requests are separate switches. CSO Online notes that applications must normally ask for MPTCP when they open a socket. Administrators can also force it through eBPF or system configuration. An audit therefore needs to cover both layers.
The exposure is broader than an MPTCP configuration suggests. Since Go 1.24, Go has requested MPTCP on listeners by default. The multipathtcp setting now defaults to 2, which enables MPTCP for listeners while leaving dialers on plain TCP. On a kernel where MPTCP is enabled, a Go service can sit in the demonstrated attack path without its author choosing MPTCP.
Go's security team addressed the issue in a note on 29 October. Neal Patel wrote that the best fix is a patched kernel. He called disabling MPTCP program by program "a fragile mitigation" and warned that the underlying bug is not specific to MPTCP. He said systems without MPTCP listeners may still be vulnerable to similar attacks.
Operators can turn MPTCP off system-wide with net.mptcp.enabled=0, as contributors noted on the oss-security list. That breaks software that needs MPTCP, and it does not remove the bug. Vendors differ here: AlmaLinux ships with MPTCP disabled, so its applications cannot open MPTCP listeners unless an administrator enables the feature.
Which kernels and distributions are patched?
Upstream fixes landed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10, plus 7.3-rc7. NVD lists those branches as unaffected at or above the named release. The commit that carries the fix was merged during the 7.3 release cycle.
Debian has shipped. Its security tracker lists DSA-6568-1 for trixie with kernel 6.12.113-1 and DLA-4841-1 for bookworm with 6.1.190-1. Unstable carries 7.2.10-1. CSO Online reports fixed packages for at least some releases from Oracle Linux, SUSE and Amazon Linux.
Ubuntu had published no fixed kernel when its tracker was last updated on 30 October. The kernel package was marked pending for four releases, including 22.04 and 24.04. It was marked needed for the older 16.04, 18.04 and 20.04 LTS releases. No Ubuntu security notice had been issued. Ubuntu rates the issue high priority rather than critical, despite the 9.8 score.
Red Hat's tracker, checked on 1 November, lists RHEL 8, 9 and 10 as affected with no fixed kernel package. RHEL 6 and 7 are marked not affected. OpenShift Container Platform 4 and 5 also appear as affected. Red Hat's analysis says default enterprise configurations accept TCP connections without special tuning. It calls reliable code execution timing-sensitive but still rates the crash risk highly.
AlmaLinux has backported the fix to every supported branch and published patched kernels in its testing repository on 30 October. The builds are kernel-4.18.0-553.180.2.el8_10, kernel-5.14.0-687.61.2.el9_8 and kernel-6.12.0-211.69.2.el10_2. Lead architect Andrew Lukoshko wrote that the project chose to ship ahead of its upstream. He said no fixed RHEL kernel existed at the time, and that the decision came from the project's technical steering committee. Distribution kernels use their own version numbers, so administrators should match the vendor build, not the upstream branch.
What should administrators do before a patched kernel arrives?
Start with inventory. Run uname -r on exposed servers and map each build to the vendor's fixed version. A host on a 6.1 kernel is not safe just because 6.1.190 exists upstream. The vendor's backport is what matters.
Patch and reboot as soon as the vendor ships a kernel. The Go team's guidance is blunt. "The best fix for this vulnerability is to upgrade to a patched kernel version." The workarounds below reduce exposure during the gap. None of them repair the race.
AlmaLinux published a host firewall rule that drops inbound TCP carrying IP options. It uses an nftables prerouting hook and the test ip hdrlength > 5, then counts and drops matches. The vendor notes that normal traffic almost never uses IPv4 options. The rule does not survive a reboot unless it is persisted.
Disabling MPTCP closes the demonstrated path. Set net.mptcp.enabled=0 system-wide, or use GODEBUG=multipathtcp=0 for individual Go programs. A godebug line in go.mod sets the same default at build time. Treat this as a stopgap, since the bug lives in ordinary IPv4 TCP code.
One oss-security contributor suggested init_on_free=1 as an extra safeguard. It zeroes freed memory, so a use-after-free read returns zeroes instead of useful contents. The contributor put the cost at roughly 1% to 5% on free-heavy workloads. It is off by default on the AlmaLinux kernels checked.
Administrators can confirm the firewall rule is active with nft list table ip cve_2026_98432. The output includes a counter showing how many packets the rule has dropped. They should also check sysctl net.mptcp.enabled before assuming a Go service sits outside the demonstrated attack path.
- •Packet filters can miss traffic between containers on the same host, as AlmaLinux warns.
- •The nftables rule would also drop forwarded packets, and it should not be used if your network relies on CIPSO security labels carried in IPv4 options.
- •Red Hat says the flaw can also crash an unpatched host, so availability risk remains.
What does an AI-written kernel exploit mean for defenders?
Anthropic frames the result as a shift in who can do this work. Its post says chained exploits once required specialist teams with deep target knowledge. It now describes models producing working exploits with little human involvement, and proving them by handing over code anyone can run.
The company is also widening access to the same capability for defenders. It expanded its Cyber Verification Program, which gives vetted security teams access to stronger models. Anthropic lists Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1 among the models available through it.
Outside researchers urge caution about the size of the shift. Jacob Krell of Suzu Labs gave Dark Reading a blunt summary. "AI has made finding the bug cheap." He added that making an exploit work on an unseen server is still the expensive part. Worker counts, builds and kernels differ from host to host.
Bolster cited VulnCheck data that only 1.3% of AI-discovered vulnerabilities were confirmed exploited in the wild. He also said model success drops sharply once ASLR, stack canaries and sandboxing are enabled. Those controls raise the cost of turning a crash into control.
Anthropic's own advice goes beyond one kernel bug. The post argues that fixing the existing backlog solves only half the problem. The other half is cutting the rate at which new flaws enter a codebase. It recommends scanning at pull-request time. The company says it released a Claude Code plugin that builds security guidance into its development process.
For engineering teams, the practical lesson is about patch latency rather than model capability. A kernel bug that needs no credentials will be exploited at the speed of the slowest supported distribution. Keeping kernel versions visible in an asset inventory matters more than debating whether a model or a person found the flaw.
What to watch next
The immediate signals are vendor advisories. Ubuntu security notices and Red Hat's RHSA pages will show when fixed kernels arrive. Both distributions lacked them on 1 November. AlmaLinux still needs community testing before its builds leave the testing repository.
Installing a kernel requires a reboot. Hosts with long reboot windows should schedule one as soon as a vendor advisory lands. Delaying the reboot leaves the vulnerable handshake code running even after the package installs.
Watch for public exploit code. Anthropic has described the mechanics but has not released a weaponised tool. Kernel proofs of concept often surface before commercial scanners add detection, and this one needs a rare packet shape.
The MPTCP angle deserves attention. Go enabled MPTCP on listeners by default in 1.24, and many cloud images run Go services. Whether other runtimes quietly enable MPTCP is still an open question.
Kernel 7.3 will carry the fix from the start. Until then, stable branches and distribution kernels rely on backports, and each vendor has its own release cadence. Anthropic's disclosure policy also sets a clock for any further detail beyond its public advisory.
Finally, watch how quickly the autonomy claim is tested. Independent reproduction of the Linux exploit, with published success rates, would settle that question better than any vendor post.