A critical flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, allows remote attackers to run commands as root, affecting Ubuntu, Red Hat, and other distributions.
The vulnerability or weakness
The vulnerability is a race condition in the TCP code that can cause the kernel to read freed memory, allowing unauthenticated attackers to exploit the flaw. Anthropic's AI model developed an exploit that takes advantage of this race condition.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-98432 | 9.8 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open (2026-10-29)
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software (2026-10-24)
- Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes (2026-10-22)
- Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases (2026-10-21)
Business impact
This vulnerability could lead to unauthorized access, data breaches, and system compromise, potentially resulting in significant financial losses and operational disruptions for affected organizations.
Industries affected
This issue affects a wide range of industries, including cloud services, enterprise IT, and any organization using Linux servers, especially those with multipath TCP listeners.
Users affected
Users of Ubuntu, Red Hat Enterprise Linux, and other Linux distributions are at risk, particularly those with unpatched systems. The lack of a fix from major vendors could leave their servers vulnerable to attacks.
