A single open port on a Linux server, such as 443 for a website or 22 for SSH, may be all an attacker needs this time. CVE-2026-98432, which Anthropic described in a research post on October 27, 2026, is a kernel flaw that can be triggered remotely with no account, password or user interaction. The Linux kernel CVE team scored it 9.8 out of 10.
What is the flaw, and where does it sit in Linux?
The bug is in the kernel’s IPv4 TCP code. When a TCP connection is set up, the two sides first perform a handshake, and packets can carry extra IP options. According to Red Hat’s description, concurrent handling of retransmitted connection requests or socket migrations creates a race condition (two operations touching the same data at overlapping times instead of in order), and those options can be freed while still in use. That is a use-after-free: memory that has been released keeps being used. The result can be a crash, memory corruption or remote code execution. BleepingComputer reports that the flaw has been in the kernel since Linux 4.4.
What exactly did Anthropic’s model do?
Anthropic says Claude wrote the exploit after initial prompting; BleepingComputer reports that it was an unreleased Claude model. The exploit has two stages. First, the race makes the kernel copy extra bytes, based on a length the attacker controls, and send them back. If one of those replies contains a kernel pointer, KASLR, the protection that randomizes the kernel’s memory layout, is defeated. Second, the same bug is used to overflow a buffer and overwrite a callback pointer, ending with a shell command of the attacker’s choice running as root. According to Anthropic, leaking the pointer took 48 minutes and reaching command execution took another five. A lost race does not crash the system, it only breaks the handshake, so an attacker can keep retrying.
Which servers are actually at risk?
The demonstrated exploit targets servers with an MPTCP listener (Multipath TCP, an extension that carries one connection over several network paths). BleepingComputer says the bug also affects ordinary TCP, but remote code execution has not been publicly demonstrated on servers without an MPTCP listener, and disabling MPTCP alone is not enough. Here is the easy-to-miss part: starting with Go 1.24, MPTCP is enabled by default for TCP listeners on Linux when the kernel supports it. So some Go services may be running MPTCP listeners without their administrators knowing.
Where do patches stand, and what should you do?
Anthropic says the fix landed upstream and was backported to all maintained stable kernel branches. Distributions are moving at different speeds. According to BleepingComputer’s October 30 report, Debian shipped fixes in 6.1.190-1 for Bookworm and 6.12.113-1 for Trixie, while Amazon Linux, Oracle Linux and SUSE had patched some kernel versions. On the same date, Ubuntu fixes were still in progress and Red Hat listed RHEL 8, 9 and 10 as affected; RHEL 7 is not affected. A kernel update only takes effect once the server reboots into the new kernel. Containers share the host’s kernel, so the host is what needs updating. Until a patch arrives, limiting access to trusted networks and, as CIQ suggests, temporarily blocking IPv4 TCP packets that carry IP options can serve as stopgaps.
What is the debate about the score?
On October 30, BleepingComputer reported that Red Hat had scored the flaw 5.9 and treated it as a potential denial-of-service issue because exploitation is complex. Red Hat’s current CVE page shows 9.8 and a Critical rating, citing the lack of any need for authentication, local privileges or user interaction. As of that report, there were no confirmed cases of exploitation in the wild.
Assessment
The facts are clear: a remotely triggered kernel flaw that needs no credentials and already has a fix. My inference goes one step further: the detail that deserves attention is that a working exploit was produced in under an hour. That suggests the gap between a patch and an attack can shrink, so “nobody is exploiting it” is true today but should not be treated as lasting protection. A practical first step is to list which services listen with MPTCP, and to put services written in Go on that list. One quick check, then onward: update the kernel, reboot, and confirm the running kernel version.
