Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions

A severe flaw in the Linux kernel's TCP code, identified as CVE-2026-98432, impacts Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's internal CVE team has rated the vulnerability at 9.8 out of a possible 10 on the CVSS scale. Anthropic disclosed on October 27 that its artificial intelligence model generated an exploit utilizing this flaw, enabling a remote attacker without credentials to execute commands as root on Linux servers equipped with a multipath TCP listener.

As of October 29, neither Ubuntu nor RHEL had released a patched kernel. Red Hat, Amazon, Oracle, and SUSE rated the vulnerability between 5.9 and 8.1, lower than the kernel team's 9.8 assessment. The vulnerability stems from a race condition in the code responsible for setting up new IPv4 TCP connections, potentially leading to the kernel accessing memory that has already been freed—a defect known as a use-after-free.

The kernel's fix acknowledges Anthropic researchers Xinyang Ge with the bug's discovery. Neither the CVE record nor the fix mentions multipath TCP (MPTCP), but Anthropic's post connects the feature to the flaw, as MPTCP enables multiple network paths to be utilized by a single connection. According to Anthropic, the vulnerability has been patched upstream and backported to all maintained stable kernel branches.

However, Ubuntu and RHEL have not yet released the corresponding fixes. Ubuntu lists its cloud, FIPS, and real-time kernels as vulnerable or in the process of being fixed. Red Hat initially deferred its fixes, but subsequently listed RHEL 8, 9, and 10, as well as OpenShift 4, as affected. Neither Red Hat nor Ubuntu has provided a release date for the fixes.

The bug occurs during the TCP handshake and can result in the kernel executing arbitrary commands with root privileges. The kernel team assigned a 9.8 CVSS score to the vulnerability, considering the attack complexity low and the exploit relatively straightforward, assuming an attacker sends a TCP connection request with specific options and then retries.

Attackers could potentially gain access to kernel memory, corrupt it, or cause the system to crash. Red Hat rated the vulnerability as Moderate, scoring it 5.9 due to the difficulty of winning the race condition, with a possible impact on confidentiality and integrity. Oracle and SUSE also rated the flaw as 8.1, aligning with the kernel team's score on most metrics, except for attack complexity, which they assessed as high.

No reported attacks using this flaw have been observed, and it does not appear in the National Vulnerability Database (NVD) or CISA's Known Exploited Vulnerabilities catalog as of October 28. To mitigate the risk, users should install the updated kernel packages from their respective distribution vendors or, if building their own kernel, ensure they are running a version patched against the vulnerability.