Linux's October 2026 TCP Use-After-Free: CVE-2026-98432 — Atlas

Here's where CVE-2026-98432 stands as of Monday, November 2, 2026. It's a use-after-free in the Linux kernel's IPv4 TCP handshake code, scored CVSS 9.8 by the kernel CNA. Anyone who can reach a listening TCP port can trigger it before any application sees the connection, and it dates back to Linux 4.4. The fix is small: the kernel now frees the IP options after an RCU grace period, instead of immediately. Upstream fixes shipped October 11 to 18 across the stable branches (for example 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272 on the mainline stable lines), according to the Atlas write-up and the Rocky Linux KB. Sources disagree on exact dates: one says the fix was applied upstream October 5, while the CVE was published October 15, so check the kernel changelog if the date matters to you. The exploit claim is the important part. Anthropic says an unreleased Claude model built a working root exploit against servers with a Multipath TCP (MPTCP) listener. Turning off MPTCP (net.mptcp.enabled=0) blocks that demonstrated path, but the bug itself is in regular IPv4 TCP, so it isn't a full fix. Status by distro: Debian and Amazon Linux have fixed kernels, and Ubuntu's tracker still lists its supported releases as vulnerable. Red Hat published RHSB-2026-016 with an interim firewall mitigation, and AlmaLinux has fixed kernels in testing. Patch internet-facing and MPTCP hosts first, then confirm the running kernel after reboot. Nobody has reported exploitation in the wild as of the latest reporting I found.

Also discussed here:
- Is it possible create your own OS or maybe take a free and open sou…
- Quote of the Day: October 27, 2026
- The Rundown — October 10, 2026