Linux Kernel TCP Flaw CVE-2026-98432: Patched Kernels by Distribution, Ubuntu Pending, RHEL Deferred

A use-after-free in the Linux kernel's IPv4 TCP handshake code, CVE-2026-98432, can be set off by an unauthenticated peer sending crafted SYN packets, and the CVE record carries a 9.8 critical score. Stable kernels with the fix were released on 15 October, yet on 30 October Ubuntu and Red Hat Enterprise Linux still had no patched packages. The flaw isn't in CISA's Known Exploited Vulnerabilities catalogue.

Why it's in the news now

On 27 October Anthropic's red team wrote that an unreleased Claude model built an exploit letting an attacker "send packets to Linux servers with a multipath TCP listener to run arbitrary commands as root", taking 48 minutes to leak a kernel pointer. The post names this flaw: "This vulnerability (CVE-2026-98432) was patched upstream". Its root exploit needs a multipath TCP listener; the bug itself sits in the ordinary IPv4 handshake. The kernel fix, written by Google's Eric Dumazet, credits an Anthropic researcher as the reporter.

The bug

An attacker sends a SYN carrying the IPv4 Record Route or Timestamp option, then races a retransmitted SYN against the connection being set up and torn down. The kernel frees the IP options while another CPU is still building a SYN-ACK from them, which leads to a use-after-free in ip_options_build(). The flaw dates back to Linux 4.4.

The score is disputed

Red Hat, SUSE, Amazon and Oracle score it 8.1, rating the attack complexity high. Red Hat's CVE page treats a crash as the realistic outcome, "with denial of service being the practical worst case", and NIST's National Vulnerability Database hasn't scored it.

What to install

The kernel CVE team lists the fix in upstream 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Distribution packages on 30 October:

• Debian: trixie 6.12.113-1 (DSA-6568-1); bookworm 6.1.190-1 (DLA-4841-1).
• Oracle Linux: Unbreakable Enterprise Kernel updates ELSA-2026-500397, 500398 and 500399, released 16 October.
• SUSE: SLE 16.0 and openSUSE Leap 16.0 have kernel-default 6.12.0-160000.40.1 (SUSE-SU-2026:24386-1); SLES 15 SP7 is still in progress.
• Amazon Linux: the AL2023 kernel6.12 package is fixed in ALAS2023-2026-3335; the default AL2023 kernel and Amazon Linux 2 are pending.
• Ubuntu: builds pending for 26.10, 26.04, 24.04 and 22.04, none yet for 20.04 and older, and no workaround listed.
• Red Hat: RHEL 8, 9 and 10 are marked "Fixes for the affected products are currently deferred to a future update". RHEL 7 isn't affected.

A kernel update only takes effect after a reboot.