CVE-2026-98432: Critical TCP Use-After-Free Vulnerability in Linux Kernel

In October 2026, stable Linux kernel releases shipped fixes for CVE-2026-98432, a critical use-after-free vulnerability located within the IPv4 TCP handshake mechanism. Rated CVSS 9.8 by the kernel's CNA, the bug affects unauthenticated remote peers and spans Linux kernel versions all the way back to version 4.4.

Key aspects of the vulnerability: - The bug affects the IPv4 TCP handshake code running in Linux kernels from version 4.4 and newer. - Assigned a critical CVSS 3.1 score of 9.8 by the maintainers. - Upstream fixes have been released in versions 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. - The upstream fix is compact, replacing standard kfree() calls with kfree_rcu() to ensure safe memory reclamation.

Technical Details and Exploitation Context

The vulnerability stems from how the kernel handles saved IPv4 options during connection establishment. When an incoming TCP connection carries options, the kernel stores them to echo in replies, passing them to the new socket without copying. Once the connection disappears, the memory is immediately freed, while another CPU core might still be reading those options to build a handshake response, causing a classic use-after-free condition.

Researchers from Anthropic revealed that their Claude AI model successfully generated a working proof-of-concept exploit capable of executing arbitrary commands as root on Linux servers equipped with a multipath TCP (MPTCP) listener, requiring zero credentials. Because a failed race condition merely drops the handshake rather than crashing the kernel, attackers can retry indefinitely until successful.

Distribution Status and Vendor Patching

Different Linux distributions have made varying progress in rolling out backported fixes. As of late October 2026, distributions such as Debian, SUSE Linux Enterprise Server 16.0 alongside 15 LTSS releases, Oracle Linux (UEK), and Amazon Linux 2023 have issued respective security advisories and updated kernel packages.

Meanwhile, other major distributions like Ubuntu and Red Hat Enterprise Linux (RHEL 8, 9, 10) have listed their respective kernel packages as vulnerable in security trackers while work on backported patches continues. Administrators are advised to monitor vendor-specific trackers rather than relying solely on upstream kernel version numbers.

Mitigation and Recommended Action

System administrators managing internet-facing Linux hosts, container nodes, and cloud environments must apply distribution-provided kernel updates immediately. Because kernel updates do not take effect dynamically, a full system reboot is required on both host machines and container nodes.

Since containers inherit the host kernel, updating container images will not mitigate the issue on vulnerable hosts. Checking for active MPTCP listeners using tools like ss -M can help identify primary exposure targets, but applying the updated kernel and rebooting remains the only complete defense against potential remote root compromise.