Linux TCP use-after-free (CVE-2026-98432): remote, unauthenticated, in the IPv4 handshake
A use-after-free in the Linux IPv4 TCP handshake lets a remote peer with no login corrupt or read kernel memory, before any application sees the connection. The upstream fix is four lines. An AI model wrote a working remote root exploit. Install your distribution's fixed kernel and reboot, then prove the running kernel.
SEVERITY
Critical
PEAK CVSS
9.8
AUTH REQUIRED
None
PUBLIC POC
Reported
PUBLISHED
Oct 31, 2026
REVISION
v1.0 · @Melly
Hayrok Research highlight
An attacker does not need a password, a phishing lure, or a vulnerable app. They need your server to answer a TCP connection. That is the whole precondition.
This flaw lives in the code every Linux machine runs the instant it accepts an IPv4 connection, in the half-second handshake before your web server, your database or your SSH daemon ever sees the request. A saved pointer to IP options is freed while another CPU is still reading it. Win that race and you are reading, or rewriting, kernel memory from across the network.
What makes CVE-2026-98432 a milestone is who wrote the exploit. The flaw was reported by an Anthropic researcher, and Anthropic says its Claude model, after initial prompting, built a proof-of-concept that runs commands as root with no credentials on servers with a multipath TCP listener. In the lab it took 48 minutes to leak a kernel pointer and five more to reach a shell. Go programs open those listeners by default. The era where a defender could count on exploit development being slow and expensive is closing.
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking a critical, remote, unauthenticated use-after-free in the Linux IPv4 TCP handshake. The kernel CNA scores it 9.8, and Red Hat raised its own rating to Critical on Oct 30. The vulnerable code runs before application authentication, so any host that accepts IPv4 TCP is reachable. An AI-built exploit targets hosts with a multipath TCP listener, which Go programs open by default. Fixed upstream on Oct 11 to 15; patch the distribution kernel and reboot.
KEY JUDGMENTS
01
Anthropic reports that its Claude model built a working remote root exploit for hosts with a multipath TCP listener. The exploit is not public, but by Oct 31 at least six GitHub repositories claimed a race trigger or PoC.Observed
02
Every Linux host that accepts IPv4 TCP on an affected kernel is in scope: web servers, SSH, databases, load balancers and Kubernetes nodes. The path runs before application authentication.Assessed
03
As of Oct 31, Ubuntu and RHEL had not shipped fixed kernels. Debian, SUSE LTSS, Oracle UEK and Amazon Linux had; AlmaLinux's were in testing.Observed
04
A container reports the host kernel, so a new image does not change exposure. Patch and reboot the host or Kubernetes node, not the container.Reproduced
Oct 1Eric Dumazet posts the fix, crediting Xinyang Ge of Anthropic as reporter.
Oct 11 to 18Stable kernels ship the fix (7.2.10, 6.18.56, then 6.12.113, 6.6.159, 6.1.190, 5.15.223, 5.10.272, and 7.3). The CVE is published Oct 15.
Oct 27Anthropic's Frontier Red Team describes a remote root exploit for the bug, built by Claude in its lab.
Oct 29The Go Security Team notes Go programs open MPTCP listeners by default since Go 1.24, widening the exploit's reach.
Oct 30Red Hat raises its rating to Critical and publishes a mitigation; Amazon Linux finishes fixing its kernels.
04 · AFFECTED PRODUCTS
Affected and fixed versions
Distribution kernels carry backported fixes under their own version numbers, so check the distribution tracker, not the upstream number. The bug goes back to Linux 4.4.
RELEASE LINE
AFFECTED
FIXED IN
STATUS
Upstream 6.12 / 6.6 / 6.1 LTS
before the fix
6.12.113, 6.6.159, 6.1.190
Fixed
Debian 12 / 13
before the update
6.1.190-1, 6.12.113-1
Fixed
Amazon Linux 2 / 2023
before the update
vendor kernel update
Fixed
Oracle Linux (UEK)
before the errata
ELSA-2026-500397 and later
Fixed
Ubuntu (all releases)
vulnerable
no fix as of Oct 31
No fix
RHEL 8 / 9 / 10
vulnerable
no fix as of Oct 31
No fix
INTERIM RULEWhile Ubuntu and RHEL have no kernel, Red Hat and AlmaLinux publish an nftables rule that drops inbound IPv4 TCP packets carrying IP options, which is how the attack arrives. It reduces exposure but does not fix the kernel.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
Hosts with an MPTCP listenerPatch and reboot first. This is the setup the AI exploit targets. Go 1.24+ services are the common case.
Ubuntu and RHEL hosts (no kernel yet)Apply the nftables interim rule and turn off MPTCP if unused, while you wait for the kernel.
HighAs kernels ship
All IPv4-facing Linux hostsInstall the fixed kernel and reboot. The fix is inert until the host boots into it.
Container and Kubernetes nodesPatch and reboot the node, not the container. A container uses the host kernel.
Edge firewallsWhere supported, drop inbound IPv4 packets with options to protect every host behind them.
HighBefore closing
Every hostRecord the running kernel after reboot, and whether an MPTCP listener is present, as evidence.
WORKAROUNDS
Drop IPv4 TCP packets with options. Add the Red Hat and AlmaLinux nftables rule: TCP almost never carries IPv4 options legitimately, so dropping them should cost nothing.Turn off multipath TCP if unused. Set net.mptcp.enabled = 0, and restart services that already opened MPTCP listeners. Set it per container too.Patch MPTCP hosts first. Those are the hosts the working exploit targets. Move them to the top of the list.Reboot is part of the fix. A patched package does nothing until the machine boots the new kernel.
06 · DETECTION AND HUNTING
Observables and hunting queries
The exploit works in kernel memory and leaves little on disk. Hunt on kernel version, on MPTCP exposure, and on the inbound option-bearing packets the attack needs.
TYPE
OBSERVABLE
SOURCE
Exposure
A running kernel below the fixed point release for its line
uname -r, distro tracker
Exposure
An MPTCP listening socket on an internet-facing host
ss -Mlnp
Request
Inbound IPv4 TCP SYNs carrying Record Route or Timestamp options
Edge firewall, packet capture
EXPOSURE · CVE-2026-98432running kernel and MPTCP listeners
uname -r
ss -Mlnp
sysctl net.mptcp.enabled
EXPOSURE · CVE-2026-98432reboot pending after a kernel update
Exploitation for Privilege Escalation (remote to root)
Assessed
08 · TECHNICAL ANALYSIS
Root cause and attack path
When a Linux server accepts a TCP connection, the kernel tracks the half-open handshake in a lightweight request socket, then creates a full socket once the handshake completes. If the peer's IPv4 header carried options, the kernel saves them to echo in its replies. The bug: the kernel handed those saved options from the request socket to the new connection without copying them, then freed them immediately when the connection went away, while another CPU could still be reading them to build a reply. Reading freed kernel memory is a use-after-free.
The peer needs no login, and it all happens inside the handshake, before any application code runs. The fix, by Eric Dumazet, changes two plain kfree() calls to kfree_rcu(), which waits until every reader has finished before freeing the memory. A lost race only fails the handshake without crashing the system, so an attacker can retry indefinitely. That retry-until-you-win property is exactly what makes an automated, AI-driven exploit practical.
01 CONNECT
Remote peer opens an IPv4 TCP handshake with options
Control: Drop inbound IPv4 TCP packets with options
02 SAVE
The kernel keeps the options to echo in replies
Control: Patch the kernel to the fixed release
03 FREE
Options are freed while another CPU still reads them
Control: Reboot into the patched kernel
04 WIN RACE
Read or corrupt kernel memory, reach root on MPTCP hosts
Fragnesia Linux LPE. A second kernel bug this month that only takes effect after a reboot.
AssessedA four-line kernel bug, reachable before authentication, with an AI-written remote root exploit. Patch cadence and reboot discipline are now the control that decides exposure.
09 · VALIDATION
Confirm remediation
An installed kernel package is not a verdict. Each host should end with evidence: a fixed kernel actually running after reboot, no exposed MPTCP listener, or the interim rule in place.
Drop inbound IPv4 TCP packets carrying options. Reduces exposure, not a fix.
nft add table ip cve_2026_98432
nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'
nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop
10 · EXPOSURE SELF-ASSESSMENT
Am I exposed?
CVE-2026-98432
01Does any host run a Linux kernel below the fixed release for its line, per the distro tracker?
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Is CVE-2026-98432 being exploited?
Anthropic reports a working AI-built remote root exploit for hosts with a multipath TCP listener, not yet public. It was not in CISA's KEV catalog as of Oct 31. Treat it as imminent.
Which kernels are affected?
Linux 4.4 and later below the fixed point releases (5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3). Check your distribution tracker, not the upstream number.
Why does multipath TCP matter?
The working exploit targets hosts with an MPTCP listener. Go programs open them by default since Go 1.24. The underlying bug is not limited to MPTCP, so other hosts may be exploitable too.
I updated the kernel package. Am I safe?
Not until the host reboots into the patched kernel. The running kernel is what is vulnerable. Containers use the host kernel, so patch and reboot the node.
VALIDATE YOUR EXPOSURE
Prove your kernel and MPTCP exposure
Hayrok reads the running kernel on each host, flags MPTCP listeners and hosts pending a reboot, and tests whether the interim rule holds. Every result lands in Evidence Fabric.