Critical Linux Kernel TCP Flaw Triggers Security Patching Delays
Anthropic-discovered race condition exposes Linux servers to potential remote root command execution.
1Critical TCP Race Condition
A severe flaw, tracked as CVE-2026-98432, affects the Linux kernel's TCP code. The vulnerability involves a race condition during IPv4 connection handshakes, leading to a use-after-free bug. The kernel's CVE team assigned a 9.8 CVSS score, citing the potential for remote attackers to execute commands as root on vulnerable servers.
2AI-Generated Exploit Discovery
Anthropic revealed on October 27 that its AI model, Claude, successfully wrote an exploit for this vulnerability. The two-stage attack bypasses KASLR by leaking kernel addresses before overwriting a callback pointer to execute root commands. Anthropic noted that failed attempts do not crash the system, allowing attackers to retry the process repeatedly.
3Vendor Scoring Discrepancies
While the kernel team rates the flaw at 9.8, major vendors report lower severity scores. Red Hat, Oracle, and SUSE initially scored the issue between 5.9 and 8.1, citing higher attack complexity. Red Hat later updated its internal tracker to high severity, though it has not yet released a stable kernel patch.
4Patch Availability Status
Upstream patches were applied on October 5, but distribution support varies significantly. Debian, Oracle Linux, SUSE, and Amazon Linux have shipped fixed packages for specific kernels. Conversely, Ubuntu and Red Hat Enterprise Linux users remain vulnerable, with Red Hat stating that fixes are deferred to a future update without a specific release date.
5Technical Mechanism of Failure
The bug occurs when the kernel fails to copy IP options during the TCP handshake, handing them to a new socket without protection. If the socket is destroyed while another CPU processes a resent request, the kernel accesses freed memory. IPv6 remains unaffected because the kernel correctly copies options for those connections.
6Mitigation and Versioning
The flaw was introduced in Linux 4.4. Developers recommend updating to the latest stable kernels, including versions 5.10.272, 6.1.190, or 7.3. No official mitigations, such as disabling multipath TCP or blocking specific IP options, have been validated by vendors as effective or stable enough for general deployment in production environments currently.
7Exploitation and Real-world Impact
As of October 29, no active exploitation of this vulnerability has been reported in the wild. The flaw does not appear in CISA's Known Exploited Vulnerabilities catalog. While Anthropic demonstrated the exploit on servers with multipath TCP listeners, the impact on servers without this specific configuration remains unconfirmed by security advisories.
8Security Operations Implications
This incident highlights the growing role of AI in identifying complex kernel-level vulnerabilities. Security teams must monitor vendor advisories closely, as the discrepancy between upstream kernel scores and distribution-specific severity ratings complicates risk assessment. Organizations should prioritize patching as soon as vendor-specific kernel packages become available to prevent potential root-level system compromise.
Original article: The Hacker News — Critical Linux Kernel TCP Flaw Triggers Security Patching Delays