What Happened
The kernel CVE team rates CVE-2026-98432 at 9.8, according to The Hacker News. The flaw is a race condition in IPv4 TCP connection setup. The kernel hands pending request options to a new socket without copying them, so a second CPU reads freed memory. The bug dates to Linux 4.4. IPv6 is not affected.
Anthropic researcher Xinyang Ge reported it. Anthropic says its Claude model wrote an exploit giving remote, unauthenticated root on servers with a multipath TCP listener. The test took 48 minutes to leak a kernel address and five more to run a command. No attacks are reported.
Why This Matters for Canadian Organizations
Ubuntu and Red Hat Enterprise Linux run much of Canadian government cloud, banking, and university infrastructure. As of October 29, neither has a fixed kernel. Vendors disagree on severity. Red Hat first scored the flaw 5.9, then raised it to 8.1. Do not wait for scores to settle. An unauthenticated root path on an internet-facing server puts personal information under PIPEDA at risk.
The disclosure also shows AI models now write working kernel exploits. Patch windows shrink when exploit development takes under an hour.
What to Do
Install fixed kernels where your distribution provides them. Debian, Oracle Linux UEK, SUSE Micro, and Amazon Linux 2023 have fixes. Upstream releases include 5.10.272, 6.1.190, 6.6.159, 6.12.113, and 6.18.56. Red Hat lists no mitigation. Sources do not confirm whether disabling multipath TCP removes the risk, so use an MPTCP inventory to rank servers for patching, not as a fix. Put internet-facing Ubuntu and RHEL hosts first and watch vendor errata daily. See more in our TechTalk archive and the News section.
