Hackerparagraph,IT-Security, Linux Image © DALL-EHackerparagraph,IT-Security, Linux (Image © DALL-E)

Use-after-free Vulnerability

The vulnerability stems from a race condition within the code responsible for establishing new IPv4-TCP connections. If the timing of the operations coincides in an unfavorable way, the kernel may attempt to access memory that has already been freed. This specific class of vulnerability is known as a “use-after-free” vulnerability.

Technical data suggests that IPv6 connections are not affected by this issue, as the kernel handles the copying of relevant options differently for IPv6 than for IPv4. The vulnerability is system-wide and appears to have existed in versions dating back to Linux 4.4. To address this, on October 5, 2026, the kernel developers implemented a fix that ensures the kernel delays the release of options until all CPUs have finished processing them.

AI-Generated Exploit and Attack Vector

The vulnerability garnered significant attention after Anthropic reported that its AI model “Claude” had successfully created a working exploit. According to the report, the attack specifically targets servers using a Multipath TCP (MPTCP) listener.

The exploit proceeds in two distinct phases: 1. Information leak: The attacker triggers the race condition to force the kernel to return additional data bytes. This allows the attacker to determine a kernel address and bypass Kernel Address Space Layout Randomization (KASLR). 2. Privilege escalation: The same vulnerability is then exploited to trigger a buffer overflow. This redirects a callback pointer to malicious code previously placed in memory, resulting in the execution of a shell command with root privileges.

In tests, the address leak process took approximately 48 minutes, while the subsequent command execution took another five minutes. Since a failed race condition merely results in a failed connection attempt, attackers can repeatedly attempt the exploit until it succeeds.

Risk Assessments by Linux Distributors

There are significant discrepancies in how different software vendors have rated the risk associated with CVE-2026-98432:

  • Linux Kernel Team: Rated the vulnerability at 9.8, assuming that an attacker sends repeated connection requests using the “IPv4 Record Route” or “Timestamp” options.
  • Red Hat: Initially rated the risk as “moderate” with a score of 5.9, arguing that the race condition would be difficult to exploit and would most likely result in a system crash. However, Red Hat later updated its security advisory to “important” with a score of 8.1.
  • Oracle and SUSE: Both assigned a score of 8.1 and differed from the kernel team primarily in that they rated the complexity of the attack as high.
  • Amazon: Assigned risk score: 7.0.

Patch Status and Resolution

Although a fix was integrated into the kernel’s mainline branch in early October, its deployment across various distributions has been inconsistent. Current status by distribution:

  • Patched: Debian, Oracle Linux, SUSE, and Amazon Linux have released patched packages for several of their kernel versions.
  • Unpatched/Pending: As of October 29, Ubuntu versions from 16.04 through 26.10 are listed as vulnerable or in progress. Red Hat Enterprise Linux (RHEL) versions 8, 9, and 10 have not yet received the fix; updates have been postponed to a later version. RHEL 7 is reportedly not affected.

For administrators who compile their own kernels, the vulnerability has been fixed in the following versions: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. The CVE team recommends upgrading to the latest stable kernel version rather than applying individual patches.

There are currently no confirmed reports of this vulnerability being exploited in the wild, and it has not yet been added to CISA’s “Known Exploited Vulnerabilities” (KEV) catalog.