A Linux TCP Race From 2016 Hands Remote Attackers Root
CVE-2026-98432, a 9.8-rated race in Linux's IPv4 TCP handshake dating to 4.4, can give a remote attacker root; Anthropic says Claude wrote a working exploit. Debian, Oracle, SUSE and Amazon have fixes; Ubuntu and RHEL are pending.
A race in the Linux kernel’s IPv4 TCP handshake code, there since Linux 4.4, can let a remote attacker with no login run code as root, and the kernel’s own CVE team rates it 9.8. The Hacker News reports Anthropic found CVE-2026-98432 and says its Claude model wrote a working root exploit. Debian, Oracle, SUSE and Amazon have fixes for some releases, but Ubuntu and RHEL don’t have patched kernels yet.
For defenders
The bug: when a new IPv4 TCP connection is set up, the kernel hands the IP options stored with the pending request to the new socket without copying them. If that socket is torn down while another CPU is still using those options to answer a retransmitted SYN, the kernel reads freed memory. The 9.8 score assumes an attacker who sends connection requests carrying IPv4 Record Route or Timestamp options and keeps resending to win the race. IPv6 isn’t affected by this path. Upstream fixed it on Oct. 5 in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3.
Scores disagree: Red Hat’s CVE page calls it Moderate (5.9), saying the race is hard to win and a crash is the likely result; its advisory data says Important (8.1), as do Oracle and SUSE. Amazon says 7.0. Anthropic’s exploit says the race is winnable: it leaked a kernel address in 48 minutes and got root five minutes later, and a lost race doesn’t crash the box, so an attacker can keep trying. Its test target had a multipath TCP (MPTCP) listener; whether servers without one are just as exposed isn’t stated. That’s T1190 (Exploit Public-Facing Application) straight to root.
Status: no exploitation in the wild reported, and not in CISA’s KEV catalog. Anthropic hasn’t released its exploit. Eleven GitHub repositories claiming proof-of-concept code are reported; treat them with suspicion, since fake PoCs are a common malware lure. EPSS is low, 0.4%.
Distro status (Oct. 29 to 30): fixed in Debian trixie (DSA-6568-1) and bookworm (DLA-4841-1, DLA-4850-1), Oracle Linux UEK, SUSE Linux Micro 6.2 and openSUSE Leap 16.0, and Amazon Linux 2023’s kernel6.18 and kernel6.12 packages. Still pending: every supported Ubuntu release, RHEL 8 to 10 and OpenShift 4, Amazon Linux 2, most SLES 15 and 16 streams. RHEL 7 isn’t affected. Red Hat says it has no mitigation it can recommend. For Go services, the Go team’s GODEBUG=multipathtcp=0 turns off MPTCP, but it calls that a fragile stopgap because the bug isn’t MPTCP-specific.
What it means for you
This lives deep inside Linux, the system behind most websites, cloud servers and many home routers and NAS boxes. You don’t need to do anything on your phone or laptop. If you run Linux servers, or a small business that rents cloud servers, this is a “patch the kernel and reboot” job as soon as your distribution ships the update.
Do this now
- Install your distribution’s fixed kernel where one exists, then reboot; a kernel update does nothing until you restart.
- On Ubuntu and RHEL, watch the vendor pages linked from Ubuntu and Red Hat and schedule the reboot for the day the fix lands.
- Until then, reduce exposure: close internet-facing TCP services you don’t need and put admin services behind a VPN.
- Don’t run “PoC” code from GitHub to test your servers.
CVE at a glance
- CVSS
- 9.8 Critical (v3.1)
- EPSS
- 0.4% chance of exploitation in the next 30 days (higher than 32.8% of CVEs)
- Exploited in the wild
- Not on CISA’s KEV list
- Public exploit
- Yes, reported in 11 GitHub repositories
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.