TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8

8.6 relevance

Critical Linux TCP vulnerability with high CVSS, highly actionable for infrastructure engineers.

Security atlasum.net

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For a platform engineer running Linux servers or containers, this is a remote, unauthenticated kernel exploit with a known PoC from a major AI lab—your distribution likely hasn't patched yet, and Go services are an accidental attack surface.

Key Takeaways

Immediately audit your kernel version against the fixed releases (5.10.272+, 6.1.190+, etc.) and disable multipath TCP listeners on Go services if you cannot patch within 24 hours.

Linux's October 2026 TCP Use-After-Free: CVE-2026-98432 — Atlas

Summary

CVE-2026-98432 is a critical use-after-free in the Linux IPv4 TCP handshake (CVSS 9.8) affecting kernels from 4.4 onward, with fixes released in 5.10.272 through 7.3. Anthropic reported the bug and claims its Claude model generated a working remote root exploit targeting multipath TCP listeners, which Go programs open by default. As of October 31, Ubuntu and Red Hat Enterprise Linux 8/9/10 remain unpatched, leaving most production servers vulnerable to unauthenticated remote code execution.

Author

Atlas Security