Linux Kernel TCP Bug Rated 9.8 Draws Conflicting Severity Scores as Ubuntu and RHEL Fixes Lag

A race condition in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux and other distributions, with the kernel's own CVE team rating it 9.8 out of 10 on the CVSS scale.

Anthropic said on October 27 that its AI model wrote an exploit using the flaw to let an unauthenticated remote attacker run commands as root on Linux servers with a multipath TCP listener. As of October 29, Ubuntu and RHEL had not released a fixed kernel. Red Hat, Amazon, Oracle and SUSE score the flaw between 5.9 and 8.1, lower than the kernel team's 9.8.

The bug is a use-after-free in the code that sets up new IPv4 TCP connections. During the handshake, the kernel hands IP options stored with a pending request to the new socket without copying them; if that socket is destroyed while another CPU still uses the options, the kernel reads freed memory. IPv6 is unaffected because its options are copied. The flaw was introduced in Linux 4.4, and developers applied a fix on October 5, ten days before the CVE was published.

The kernel fix credits Anthropic researcher Xinyang Ge with reporting the bug. Neither the CVE record nor the fix mentions multipath TCP; the link to that feature comes from Anthropic's post. Anthropic says the flaw was patched upstream and backported to maintained stable branches, but distribution users receive it only through their vendor's kernel package. Debian, Oracle Linux, SUSE and Amazon Linux have shipped fixed packages for at least some kernels; Ubuntu and RHEL have not, and neither gives a release date.

Red Hat rates the flaw Moderate at 5.9, calling the race hard to win and the most likely outcome a kernel crash, while its advisory file lists Important at 8.1. Oracle and SUSE also score 8.1, matching the kernel team on every metric except attack complexity, which vendors rate high and the kernel team low. Amazon scores it 7.0.

Anthropic's exploit works in two stages: the race first leaks a kernel address to defeat KASLR, then a buffer overflow overwrites a callback pointer with a payload that runs a shell command as root. A lost race only fails that connection attempt, so an attacker can keep trying; in Anthropic's test, leaking an address took 48 minutes and command execution five more. The post omits the exploit code, kernel version and tested configuration.

As of October 29, no vendor advisory, the CVE record or Anthropic's post reports attacks using the flaw. Where a fixed kernel is available, install it; those building their own can find the fix in Linux 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Red Hat says no available mitigation meets its standards, and the advisories do not say whether disabling multipath TCP or blocking connection requests carrying IP options would reduce risk.

Source: The Hackers News