On this page

Linux TCP flaw: update the kernel on website hosts

By Tornike@realtornikeoPublished Nov 4, 2026Last updated Nov 4, 2026

Original sources: Linux CVE record: affected and fixed upstream versions; Anthropic: exploit research; Red Hat: affected products and mitigation; AWS: kernel updates and exploitation status; Go team: MPTCP listener guidance

Does this apply to me?

Linux kernel IPv4 TCPUpstream 4.4 onward, before the fixed release for each branch: Vulnerable kernel with IPv4 TCP networking. Inbound listeners are directly exposed to reachable clients. Distribution backports can change package status.Action: Upstream 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Check your distribution's advisory for its package.

How severe is it?

Critical: CVSS 9.8

A successful attack can execute code with kernel privileges. A crash or disclosure of kernel memory is also possible. Anthropic's demonstration establishes an exploit under its tested conditions; it does not establish compromise of a production host.

The Linux CVE authority rates the flaw Critical, CVSS v3.1 9.8. Red Hat also rates it Critical.

First reported Oct 15, 2026

CVE-2026-98432

What happened

The Linux CVE record published this flaw on October 15. Anthropic later demonstrated remote command execution as root against a server with an MPTCP listener. The race occurs in IPv4 TCP connection handling before application authentication. AWS said on November 3 it had no evidence the issue had been leveraged.

An attacker needs network access to an affected IPv4 TCP listener and must send crafted packets with IP options. The demonstrated exploit uses MPTCP, while the underlying flaw also affects ordinary TCP handling. Go programs have enabled MPTCP by default for Linux listeners since Go 1.24.

What to do now

Install your distribution's fixed kernel package and reboot, or follow its supported live-patching guidance. Verify the running kernel afterward. Update container hosts and cluster nodes as well.
If a fix is unavailable, assess your vendor's guidance for filtering inbound IPv4 packets carrying IP options. Test the rule against your traffic and make it persistent where appropriate.
Treat disabling MPTCP as a partial measure. The Go team warns that per-program settings can miss listeners and that other exploit paths may exist.

What this means for your website

The kernel handles connections before a website's login or application code. Prioritize hosts reachable by untrusted clients, including origins behind a proxy when clients can reach them directly. Check the actual network path and the host kernel rather than relying on the application version.

Sources and updates

This brief reflects the sources checked on Nov 4, 2026. Follow the linked vendor notices for subsequent corrections and updates.

Find your own weak spots.

Test your live website and give your coding agent evidence it can act on.

Set up your agent →