# Critical Linux TCP Vulnerability CVE-2026-98432 Exposes Servers to Remote Exploitation A severe use-after-free flaw in the IPv4 handshake allows unauthenticated remote code execution. - **Source:** [Hacker News](https://news.ycombinator.com) - **Published:** 2026-10-31 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/52e6dc5e-b473-4969-b484-28e11683b138 ## Critical Kernel Security Flaw The Linux kernel contains a critical use-after-free vulnerability, tracked as CVE-2026-98432, affecting versions since 4.4. With a CVSS score of 9.8, the bug allows remote, unauthenticated attackers to potentially execute code as root. The flaw resides in the IPv4 TCP handshake process, occurring before any application-level security controls can intervene. ## Technical Root Cause Explained The vulnerability occurs when the kernel handles IPv4 header options during a TCP handshake. It fails to copy these options when moving from a request socket to a full socket, freeing the memory while another CPU might still be reading it. This race condition allows access to freed kernel memory. ## Exploitation and Impact Potential Anthropic researchers, who reported the bug, confirmed that their Claude model successfully generated a proof-of-concept exploit. This exploit targets multipath TCP listeners, which are enabled by default in Go programs. Attackers can leak kernel heap memory, perform out-of-bounds writes, or crash the system by retrying the handshake indefinitely. ## Upstream Kernel Fixes Released Official upstream fixes were released between October 11 and October 15, 2026. The patch, authored by Eric Dumazet and reviewed by Kuniyuki Iwashima, replaces standard kfree() calls with kfree_rcu(). This change ensures memory is only freed after an RCU grace period, preventing active readers from accessing invalid or stale kernel memory. ## Distribution Patching Status Varies Patch availability differs significantly across Linux distributions. Amazon Linux and SUSE have released updates for most kernels. Conversely, as of late October, Ubuntu and Red Hat reported many versions as still vulnerable. Users must check specific distribution trackers rather than relying on upstream kernel version numbers to verify their protection status. ## Red Hat and Oracle Responses Red Hat classifies the bug as Critical, affecting RHEL 8, 9, 10, and OpenShift. While they provide mitigation advice, they initially lacked a direct kernel fix. Oracle Linux rated the issue as Important with a CVSS of 8.1, having released Unbreakable Enterprise Kernel errata on October 16 to address the specific vulnerability. ## Container Environment Vulnerability Risks The vulnerability affects any Linux system running an unpatched kernel, regardless of whether it serves the network directly or hosts containers. Because containers share the host's kernel, updating container images is insufficient. Administrators must patch the underlying host kernel to effectively mitigate the risk posed by this TCP handshake flaw. ## IPv6 Protocol Safety Status According to the official fix commit, the primary vulnerability is isolated to IPv4 TCP handshake handling. IPv6 connections are not affected by this specific issue. However, administrators should remain vigilant, as the commit notes that related IPv6 cases may be addressed in future, separate patches to ensure comprehensive network stack security. ## Mitigation and Remediation Efforts AlmaLinux has moved fixed kernels into testing repositories, prioritizing community validation before production deployment. Debian has successfully patched versions 12 and 13. Meanwhile, Ubuntu continues to list several releases as vulnerable, with work in progress for specific packages. Organizations should prioritize patching internet-facing servers that utilize multipath TCP listeners immediately. ## The Role of Automated Research The discovery of CVE-2026-98432 highlights the increasing role of AI in security research. Anthropic's use of the Claude model to develop a functional exploit demonstrates how automated systems can identify and weaponize complex kernel-level bugs. This development underscores the necessity for rapid patching cycles in modern, highly connected server environments. ## Security Analysis and Discrepancies While the kernel's CVE Numbering Authority assigned a 9.8 Critical score, Red Hat maintains a slightly lower assessment of 8.1. Red Hat characterizes the attack complexity as high and notes the result is often a system crash rather than guaranteed code execution, reflecting different interpretations of the exploit's real-world impact. ## Ongoing Monitoring Requirements As of late October 2026, the NVD lists the vulnerability as received but lacks independent analysis. System administrators must monitor official security bulletins from their respective vendors. Given the ease of exploitation for unauthenticated remote peers, applying kernel updates remains the only definitive method to secure systems against this flaw. ## Sources covering this story - [Hacker News — Critical Linux TCP Use-After-Free Vulnerability CVE-2026-98432](https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf) - [Hacker News (news.ycombinator.com) — Critical Linux TCP Use-After-Free Vulnerability CVE-2026-98432](https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf) - [cybersecurity — Critical Linux Vulnerability CVE-2026-98432 Exposes Millions of Servers](https://www.reddit.com/r/cybersecurity/comments/1xnqw4a/attackers_are_scanning_the_internet_for_linux/) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._