A critical Linux kernel vulnerability can enable unauthenticated remote code execution as root on certain servers, after Anthropic reported that an unreleased Claude research model developed a working exploit for the flaw. Tracked as CVE-2026-98432, the issue affects the kernel’s IPv4 TCP connection-establishment code and has a CVSS score of 9.8, according to the National Vulnerability Database. [16]
The bug is a race-condition use-after-free involving the inet_opt and ireq_opt structures. During TCP connection handling, tcp_v4_syn_recv_sock() can transfer an IP-options pointer to a child socket while another CPU is still using it to build a SYN-ACK. The kernel can then release the memory with a normal kfree(), allowing a concurrent execution path to access freed memory. The Debian security tracker says the flaw can also arise during request-socket migration, including configurations using net.ipv4.tcp_migrate_req=1 or certain BPF reuse-port programs. [1]
Anthropic said its model produced an exploit targeting Linux servers with a multipath TCP listener. The reported chain first used the memory-corruption condition to disclose a kernel pointer and weaken kernel address-space-layout randomization, then corrupted a callback pointer to execute an attacker-controlled command. The demonstration reportedly required about 48 minutes to obtain the information leak and another five minutes to reach a root shell, making it a laboratory proof of capability rather than evidence of a fast, automated attack.
The upstream fix changes the relevant cleanup paths to use kfree_rcu(), allowing readers protected by RCU to finish before the memory is reclaimed. Fixed versions have been backported across maintained stable branches, including 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10; the mainline fix is listed for 7.3-rc7. Debian lists fixes in Bookworm’s security kernel 6.1.190-1, Trixie’s 6.12.113-1 and the corresponding 6.12 Bookworm package. Administrators should use their distribution’s package rather than compiling solely from the upstream version number.
Red Hat describes the issue as a remotely triggerable race in the IPv4 networking subsystem and advises customers to monitor its CVE-2026-98432 advisory for product-specific status and errata. Ubuntu and other distributions may ship fixes under different package revisions, so defenders should apply the latest kernel security update and reboot where required. Hosts that do not need multipath TCP should also review whether its listeners can be disabled, but that is only a temporary exposure-reduction measure, not a substitute for patching.
There is no verified evidence that CVE-2026-98432 is being exploited in the wild, and current reporting does not place it in the CISA Known Exploited Vulnerabilities catalog. The absence of observed attacks should not lessen the urgency: the public technical description, high severity rating and reported remote-root exploit make unpatched internet-facing Linux systems a priority for inventory, update and monitoring.
