Linux stable kernels shipped fixes on October 11 and 15, 2026 for CVE-2026-98432, a critical use-after-free in the IPv4 TCP handshake (CVSS 3.1 9.8). The vulnerability, present since Linux 4.4, allows a remote, unauthenticated peer to trigger kernel memory corruption or denial of service when accepting an IPv4 TCP connection. An upstream four-line fix was committed, but distribution kernels lag behind. As of October 29, Ubuntu marks all releases as "Vulnerable" with no Security Notice published. Red Hat lists RHEL 8, 9, and 10 as affected with no fix available. Anthropic researcher Xinyang Ge reported the bug; the researcher claims Claude built a remote root exploit targeting servers with multipath TCP listeners. Fixed kernel versions include 6.1.190, 6.6.159, 6.12.113, 5.15.223, 5.10.272, 6.18.56, and 7.2.10. IPv6 connections are not affected. The bug resides in IPv4 option data processing during the TCP handshake, exposing kernel memory to remote peers.
Key facts reveal Red Hat rates it Important (CVSS 8.1), Ubuntu rates it High, while SUSE and Oracle/Amazon rate it Important. The upstream fix targets IPv4 only, noting IPv6 is unaffected. No CWE is assigned to the weakness. The CNA scoring notes potential kernel heap contents disclosure, memory corruption, or crashes. Distribution kernels carry backported fixes under their own version numbers, requiring tracker checks rather than upstream numbers. Proof-of-concept code exists but has not been publicly released.
Distribution status shows Ubuntu tracker lists linux package as "Vulnerable" on every release. Red Hat RHEL 8, 9, 10 and Open Shift Container Platform 4 are affected with no fix. Debian fixed in 12 "bookworm" (6.1.190...).
Source: Hacker News · Summarized by HeadlinesBriefing