Source: https://agentdast.com/newsletter/linux-ipv4-tcp-use-after-free-cve-2026-98432

# Linux TCP flaw: update the kernel on website hosts

[By Tornike (@realtornikeo)](https://x.com/realtornikeo)

 Published Nov 4, 2026  Last updated Nov 4, 2026 

Original sources: [Linux CVE record: affected and fixed upstream versions](https://www.cve.org/CVERecord?id=CVE-2026-98432); [Anthropic: exploit research](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude); [Red Hat: affected products and mitigation](https://access.redhat.com/security/vulnerabilities/RHSB-2026-016); [AWS: kernel updates and exploitation status](https://aws.amazon.com/security/security-bulletins/2026-160-aws/); [Go team: MPTCP listener guidance](https://www.openwall.com/lists/oss-security/2026/10/30/1)

## Does this apply to me?

**Linux kernel IPv4 TCP** Upstream 4.4 onward, before the fixed release for each branch 

Vulnerable kernel with IPv4 TCP networking. Inbound listeners are directly exposed to reachable clients. Distribution backports can change package status.

Action: Upstream 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Check your distribution's advisory for its package.

## How severe is it?

**Critical: CVSS 9.8**

A successful attack can execute code with kernel privileges. A crash or disclosure of kernel memory is also possible. Anthropic's demonstration establishes an exploit under its tested conditions; it does not establish compromise of a production host.

The Linux CVE authority rates the flaw Critical, CVSS v3.1 9.8. Red Hat also rates it Critical.

First reported Oct 15, 2026

`CVE-2026-98432`

## What happened

The Linux CVE record published this flaw on October 15. Anthropic later demonstrated remote command execution as root against a server with an MPTCP listener. The race occurs in IPv4 TCP connection handling before application authentication. AWS said on November 3 it had no evidence the issue had been leveraged.

An attacker needs network access to an affected IPv4 TCP listener and must send crafted packets with IP options. The demonstrated exploit uses MPTCP, while the underlying flaw also affects ordinary TCP handling. Go programs have enabled MPTCP by default for Linux listeners since Go 1.24.

## What to do now

1.  Install your distribution's fixed kernel package and reboot, or follow its supported live-patching guidance. Verify the running kernel afterward. Update container hosts and cluster nodes as well.
2.  If a fix is unavailable, assess your vendor's guidance for filtering inbound IPv4 packets carrying IP options. Test the rule against your traffic and make it persistent where appropriate.
3.  Treat disabling MPTCP as a partial measure. The Go team warns that per-program settings can miss listeners and that other exploit paths may exist.

## What this means for your website

The kernel handles connections before a website's login or application code. Prioritize hosts reachable by untrusted clients, including origins behind a proxy when clients can reach them directly. Check the actual network path and the host kernel rather than relying on the application version.

## Sources and updates

-   [Linux CVE record: affected and fixed upstream versions ↗](https://www.cve.org/CVERecord?id=CVE-2026-98432)
-   [Anthropic: exploit research ↗](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude)
-   [Red Hat: affected products and mitigation ↗](https://access.redhat.com/security/vulnerabilities/RHSB-2026-016)
-   [AWS: kernel updates and exploitation status ↗](https://aws.amazon.com/security/security-bulletins/2026-160-aws/)
-   [Go team: MPTCP listener guidance ↗](https://www.openwall.com/lists/oss-security/2026/10/30/1)

This brief reflects the sources checked on Nov 4, 2026. Follow the linked vendor notices for subsequent corrections and updates.

### Find your own weak spots.

Test your live website and give your coding agent evidence it can act on.

[Set up your agent →](https://agentdast.com/agents)

## Keep reading

-   [eMudhra CA keys compromised: update trust stores and check certificate chains](https://agentdast.com/newsletter/emudhra-certificate-authority-key-compromise)
-   [Node2Shell: update Brotli decoders across your website stack](https://agentdast.com/newsletter/node2shell-brotli-cve-2026-111497)