Linux Kernel TCP Flaw CVE-2026-98432 Opens Remote Root Access
A Linux kernel TCP flaw dating back to version 4.4 lets an attacker take root on a server with no password and no clicks. An AI model built a working exploit in 53 minutes. Ubuntu still has no fixed kernel.
What Happened?
Tracked as CVE-2026-98432, the bug sits in the IPv4 TCP handshake. A connection request (SYN) carrying a Record Route or Timestamp option hands those options to the new socket without copying them. A retransmitted SYN on another CPU can then read that memory after it’s freed.
The kernel CVE team published it on October 15 and scored it 9.8 on October 24. On October 27, Anthropic’s Frontier Red Team said an internal AI model turned the race into remote root on a multipath TCP (MPTCP) server: about 48 minutes to beat KASLR, 5 more for a root shell.
Four weeks of patches. 53 minutes to exploit.
How the Linux kernel TCP flaw moved from a quiet upstream fix to a working AI exploit, while distro kernels arrived one by one.
- Oct 5Upstream kernel fix landsIPv4 options now freed after an RCU grace period.
- Oct 15CVE publishedUse after free in the IPv4 TCP handshake, present since kernel 4.4.
- Oct 16 to 22Oracle Linux and Debian ship fixes
- Oct 24Kernel CVE team scores it 9.8
- Oct 27AI model builds remote root exploitAbout 48 minutes to beat KASLR, 5 more for a root shell.
- Oct 30Amazon Linux 2 and 2023 fixed
- Nov 1Red Hat fixes RHEL 8, 9 and 10
- Nov 3Ubuntu still vulnerableFixes in progress for 22.04 and later.
The fix existed upstream 22 days before the exploit. Most of the exposure sat in the gap between upstream and your servers.
Who’s Patched and Who Isn’t
Oracle Linux and Debian shipped fixes by mid-October, Amazon Linux by October 30, and SUSE is still rolling out. Red Hat followed on November 1 with fixes for RHEL 8, 9, and 10. As of November 3, Ubuntu lists every supported release from 16.04 to 26.10 as vulnerable, with fixes in progress for 22.04 and later.
Vendors Disagree on the Severity Score
Scores split, too. The kernel team, Ubuntu, and Red Hat say 9.8. Oracle, SUSE and Amazon say 8.1, rating the race as hard to win.
Who’s patched for CVE-2026-98432?
Fixed kernels are out for most major distributions. Ubuntu is the big holdout, and vendors still disagree on the score.
A fixed package does nothing until the host reboots into the new kernel. Check the running kernel, not the installed one.
The Listener Nobody Asked For
Go 1.24 and later open MPTCP listeners by default wherever the kernel allows it, and Debian and Ubuntu kernels ship with MPTCP enabled. The bug itself lives in plain IPv4 TCP, though, and Go’s security team warns that servers without MPTCP listeners may face similar attacks. Turning MPTCP off shrinks exposure without closing the hole.
What’s the Impact?
Anyone who can reach an open IPv4 TCP port can try this. Root on a Linux host exposes credentials, keys, and customer data. Any cloud VM, container host, or Kubernetes node with an open port and an unpatched kernel is in range. No attacks have been reported in the wild yet.
From one SYN packet to root, no login needed.
The exploit an AI model built against a Linux server with a multipath TCP listener needed nothing but a reachable IPv4 TCP port.
If your team is still working through another Linux kernel flaw, put this one in the same queue.
How to Avoid This
- Patch, then reboot. A fixed kernel does nothing until the host restarts. Confirm the fix with your distro’s changelog, since backported fixes hide behind old version numbers.
- Block the trigger. Red Hat’s bulletin and Ubuntu’s CVE page give an nftables rule that drops IPv4 TCP packets carrying IP options.
ip hdrlength > 5). Test it first and treat it as a stopgap. - Shrink the attack surface. Run
ss -lnMpto find MPTCP listeners. For Go services, setGODEBUG=multipathtcp=0and restart them. Thenet.mptcp.enabled=0sysctl only stops new MPTCP sockets. - Internet-facing first. Patch hosts with public IPv4 ports before internal ones.
- Track the Ubuntu fix. Install the fixed kernel the day it lands on the Ubuntu CVE tracker.
Signs of CVE-2026-98432 Probing on Your Hosts
No vendor or CERT has published hashes, IP addresses or detection rules for this flaw. These are the network, host and exposure signals that do exist.
What to look for on your Linux hosts
Network, host and exposure signals for the Linux kernel IPv4 TCP use after free. Status as of November 3, 2026.
Network indicators
| Indicator | Detail | Source |
|---|---|---|
| Inbound IPv4 TCP SYN with IP options | IP header length above 20 bytes (ip hdrlength > 5) on TCP packets. Legitimate traffic rarely carries IPv4 options. | Published |
| Record Route or Timestamp option | IPv4 option type 7 (Record Route) or 68 (Timestamp) on a SYN. These are the options the bug mishandles. | Published |
| Bursts of retransmitted SYNs with options | Repeated SYNs with options from one source to the same port over a long window. The demonstrated exploit needed roughly 48 minutes of attempts. | Inferred |
| nftables drop counter rising | If you deployed the mitigation rule, check nft list table inet cve_2026_98432. A climbing counter means someone is sending option packets. | Published |
Host indicators
| Indicator | Detail | Source |
|---|---|---|
| Kernel oops or crash traces | Stack traces naming ip_options_build, ip_build_and_send_pkt, tcp_v4_send_synack or skb_under_panic. Check with journalctl -k | grep -i ip_options_build. A quiet log is not proof of safety. | Published |
| Unexpected root processes after SYN floods | New root owned shells or processes with no login or cron origin, close in time to option packet bursts. | Inferred |
Exposure checks
| Check | Command |
|---|---|
| Running kernel | uname -r compared with your distro advisory |
| Fix in running kernel (Ubuntu/Debian) | zgrep -c CVE-2026-98432 /usr/share/doc/linux-modules-$(uname -r)/changelog.Debian.gz |
| Fix in running kernel (RHEL family) | rpm -q --changelog kernel-core-$(uname -r) | grep -c CVE-2026-98432 |
| MPTCP enabled | sysctl net.mptcp.enabled |
| MPTCP listeners | ss -lnMp (empty output means none) |
| Request migration path | sysctl net.ipv4.tcp_migrate_req (1 opens a second trigger path) |
Reference
| Upstream fix commit | e3f33b0a1d89d738e2b913dab519226eaf76e15b |
| Fixed stable kernels | 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3 |
| MITRE ATT&CK | T1190 Exploit Public Facing Application · T1068 Exploitation for Privilege Escalation |
Sources: Ubuntu and Debian CVE trackers, Red Hat bulletin RHSB-2026-016, Go security advisory on oss-security (Oct 30). “Inferred” rows are analyst suggestions, not published vendor signatures.
Your Patch Window Is Longer Than 53 Minutes
An AI turned this bug into root in under an hour. Most teams need days to work out which servers are exposed, usually from a spreadsheet. Secure.com closes that gap with:
- A live asset inventory showing which Linux hosts run an affected kernel and which expose MPTCP listeners
- Risk scoring that puts internet-facing servers at the top of the patch queue
- Continuous external scans that show your open ports the way an attacker sees them