Linux Kernel TCP Flaw Scores CVSS 9.8 as Anthropic AI Demonstrates Root Access in 53 Minutes

Posted on Oct 31 • Originally published at joho-todai.com • AI-assisted

CVE-2026-98432, a CVSS 9.8 vulnerability in Linux kernel TCP code, has been confirmed, with an unreleased Anthropic AI model demonstrating unauthenticated root access in 53 minutes. Ubuntu and RHEL patches remained unavailable as of October 30.

CVE-2026-98432, a CVSS 9.8 vulnerability, has been confirmed in Linux kernel TCP code. An unreleased Anthropic AI model demonstrated unauthenticated root access in 53 minutes. Ubuntu and RHEL patches remained unavailable as of October 30.

A CVSS 9.8 use-after-free vulnerability has been confirmed in the Linux kernel's IPv4 TCP connection handling. Its identifier is CVE-2026-98432. NVD published the CVE record on October 15, local time, and both kernel.org and cve.org assess its vector as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network-accessible, low attack complexity, no privileges required, and no user interaction. Confidentiality, integrity, and availability impacts are all high.

The core issue is a race condition during TCP connection establishment.

When the TCP three-way handshake completes, the kernel transfers ownership of IP options associated with the incoming connection request to a new socket, the communication endpoint. However, it moves only the pointer, the memory address, rather than copying the option data. If another CPU core simultaneously handles a retransmitted SYN packet for the same request, it reads memory already transferred to the new socket and freed at its original location. This produces a memory safety flaw known as use-after-free.

I confirmed that the kernel patch was written by Google's Eric Dumazet after a report from Anthropic's Xinyang Ge, committed on October 1 and merged on October 5, local time. The two-line change replaces kfree() with kfree_rcu(), delaying memory release until other CPUs finish reading the options under RCU (Read-Copy-Update), the kernel mechanism that waits for readers to finish before freeing data.

The vulnerability affects all Linux kernel versions from 4.4, released in 2016, onward. Equivalent IPv6 code copies the options, so only IPv4 is affected.

On October 27, local time, Anthropic published findings from using an unreleased internal research model to discover and demonstrate vulnerabilities in major software. The CVE-2026-98432 exploit was reported as one of five demonstrations, alongside attack chains targeting Chrome, Safari, the Android lock screen, and Windows.

According to Anthropic, after an initial prompt, the Claude model independently built an exploit achieving unauthenticated command execution as root, without user interaction, on a Linux server running an MPTCP (Multipath TCP) listener. MPTCP allows one TCP connection to use multiple network paths simultaneously.

The first exploits the race condition to bypass KASLR, Kernel Address Space Layout Randomization, which randomizes kernel code and function locations to prevent attackers from predicting them. By making the kernel read an attacker-controlled length field, it causes more bytes than intended to be returned. If the response contains kernel pointers, the kernel memory layout becomes known. This stage took 48 minutes.

The second uses the same use-after-free to overflow a buffer and overwrite a callback pointer, the address of the next function the kernel will invoke, with the address of an attack payload previously placed in kernel memory. When the kernel calls that pointer, the attacker's specified shell command executes as root. This stage took another five minutes, achieving remote root access in 53 minutes total.

The race has a useful property for attackers: losing it causes only one handshake to fail, without crashing the system. Attackers can retry until they succeed.

Anthropic has not released the exploit code, tested kernel version, or test environment configuration. The discoveries were reported to vendors under Anthropic's coordinated disclosure policy, which gives developers 90 days for fixes and another 45 days before detailed publication.

Anthropic demonstrated root-level remote code execution only on a server running an MPTCP listener. The same attack has not yet been demonstrated on servers without such listeners.

However, administrators cannot necessarily assume MPTCP listeners are absent from their servers.

Since Go 1.24, TCP listeners enable MPTCP by default when the kernel supports it. Network services written in Go may therefore start MPTCP listeners without administrators realizing.

In an October 29 statement, local time, the Go Security Team described disabling it at runtime with GODEBUG=multipathtcp=0, or at build time through the go.mod file by adding godebug multipathtcp=0. Code calling SetMultipathTCP overrides either setting, however.

The Go Security Team also called per-program MPTCP disabling a fragile mitigation. A single remaining MPTCP listener leaves the system vulnerable, and because the underlying bug is not specific to MPTCP, systems without MPTCP listeners may also be vulnerable to similar attacks. It said upgrading to a patched kernel is the best defense.

The same problem can also arise with TCP request socket migration, when net.ipv4.tcp_migrate_req is enabled or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is used.

Figure omitted — see the original article

The vulnerability is fixed upstream and backported to all maintained stable kernel branches. Distribution availability varies.

Debian responded quickly. Its security tracker lists fixes in kernel package 6.1.190-1 for Debian 12 (Bookworm) and 6.12.113-1 for Debian 13 (Trixie). Fixed packages are also available in testing and unstable.

Ubuntu had no fix available as of October 30. Canonical's tracker lists 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 as vulnerable, with kernel fixes in progress.

For RHEL, Red Hat initially rated the issue 5.9 (Moderate), but the situation has changed. On October 30, local time, Red Hat published security bulletin RHSB-2026-016, rating the impact Critical and working to expedite fixes. Its CVE page now displays CVSS 9.8. RHEL 8, 9, 10, and OpenShift Container Platform are affected. RHEL 7 lacks the vulnerable code and is unaffected.

For context on these changing ratings, Red Hat's CVE page initially showed 5.9 (Moderate), its machine-readable advisory showed 8.1 (Important), and its bug tracker changed from medium to high on October 29. The October 30 bulletin raised the rating to Critical.

For Rocky Linux, support provider CIQ confirmed impacts on versions 8, 9, and 10 and shared an interim firewall mitigation.

Oracle Linux, Amazon Linux, and SUSE have released fixes for some affected kernel versions.

For environments awaiting patches, Red Hat's bulletin provides a specific nftables rule. It drops incoming IPv4 TCP packets whose IP header length exceeds the standard five, meaning options are present, before they reach the vulnerable TCP processing code.

table inet cve_2026_98432 { chain input { type filter hook input priority -310; policy accept; ip protocol tcp ip hdrlength > 5 counter drop } }

Red Hat says effects on normal application traffic are generally not expected, while advising administrators to review their own traffic and requirements before applying it.

Importantly, disabling MPTCP alone is insufficient. Ordinary TCP traffic can trigger the underlying vulnerability, so turning MPTCP off does not provide a defense by itself.

macOS uses Apple's XNU kernel and is unaffected.

As of October 30, no reports of CVE-2026-98432 exploitation in real-world attacks had been confirmed.

Anthropic reported five attack chains. Chrome findings received 62 CVEs, all critical or high, including 13 sandbox escapes. The Safari chain escaped the sandbox and disabled the same-origin policy. The work also included an Android lock screen bypass and remote denial of service against Windows' HTTP/3 implementation. Anthropic says the Claude model independently discovered these issues and built working exploits after an initial prompt.

AI's large-scale discovery of software vulnerabilities (in Japanese) is already changing everyday Linux kernel development. Reports have reached five to 10 per day, deprecation of the AF_ALG interface (in Japanese) has been decided to reduce the kernel's attack surface, and a killswitch mechanism for temporary protection while patches remain unapplied (in Japanese) has been proposed.

What differs this time is that AI did not stop at discovery: it assembled a complete attack chain bypassing kernel memory protections and obtaining root privileges. Both the 48-minute persistence in waiting for a successful race and the second-stage design using KASLR information to hijack control flow were traditionally considered skills held by only a few specialist teams.

The patch merged on October 5 and has reached upstream kernels. For Ubuntu and RHEL users, however, the gap before patched kernel packages arrive continues.

Originally published on Joho no Todai. The Japanese original is here.