# Critical Linux Kernel TCP Flaw Triggers Security Patching Delays

Anthropic-discovered race condition exposes Linux servers to potential remote root command execution.

- **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563)
- **Published:** 2026-10-29
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html>
- **On Brifing:** https://brifing.si/s/120e49ba-2c61-4672-a8aa-4e1dbb0e512a

## Critical TCP Race Condition

A severe flaw, tracked as CVE-2026-98432, affects the Linux kernel's TCP code. The vulnerability involves a race condition during IPv4 connection handshakes, leading to a use-after-free bug. The kernel's CVE team assigned a 9.8 CVSS score, citing the potential for remote attackers to execute commands as root on vulnerable servers.

## AI-Generated Exploit Discovery

Anthropic revealed on October 27 that its AI model, Claude, successfully wrote an exploit for this vulnerability. The two-stage attack bypasses KASLR by leaking kernel addresses before overwriting a callback pointer to execute root commands. Anthropic noted that failed attempts do not crash the system, allowing attackers to retry the process repeatedly.

## Vendor Scoring Discrepancies

While the kernel team rates the flaw at 9.8, major vendors report lower severity scores. Red Hat, Oracle, and SUSE initially scored the issue between 5.9 and 8.1, citing higher attack complexity. Red Hat later updated its internal tracker to high severity, though it has not yet released a stable kernel patch.

## Patch Availability Status

Upstream patches were applied on October 5, but distribution support varies significantly. Debian, Oracle Linux, SUSE, and Amazon Linux have shipped fixed packages for specific kernels. Conversely, Ubuntu and Red Hat Enterprise Linux users remain vulnerable, with Red Hat stating that fixes are deferred to a future update without a specific release date.

## Technical Mechanism of Failure

The bug occurs when the kernel fails to copy IP options during the TCP handshake, handing them to a new socket without protection. If the socket is destroyed while another CPU processes a resent request, the kernel accesses freed memory. IPv6 remains unaffected because the kernel correctly copies options for those connections.

## Mitigation and Versioning

The flaw was introduced in Linux 4.4. Developers recommend updating to the latest stable kernels, including versions 5.10.272, 6.1.190, or 7.3. No official mitigations, such as disabling multipath TCP or blocking specific IP options, have been validated by vendors as effective or stable enough for general deployment in production environments currently.

## Exploitation and Real-world Impact

As of October 29, no active exploitation of this vulnerability has been reported in the wild. The flaw does not appear in CISA's Known Exploited Vulnerabilities catalog. While Anthropic demonstrated the exploit on servers with multipath TCP listeners, the impact on servers without this specific configuration remains unconfirmed by security advisories.

## Security Operations Implications

This incident highlights the growing role of AI in identifying complex kernel-level vulnerabilities. Security teams must monitor vendor advisories closely, as the discrepancy between upstream kernel scores and distribution-specific severity ratings complicates risk assessment. Organizations should prioritize patching as soon as vendor-specific kernel packages become available to prevent potential root-level system compromise.

## Sources covering this story

- https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._