A critical flaw in the Linux kernel's handling of incoming internet connections can be triggered by a remote attacker with no login, and researchers have shown it leading to full control of a server. The flaw, tracked as CVE-2026-98432, carries the maximum practical severity score of 9.8 out of 10.

The bug is a use-after-free race condition in the code that sets up new IPv4 TCP connections, present in the kernel since version 4.4 — so almost any internet-facing Linux server could be in scope. The upstream fix was merged on 5 October 2026 and the CVE published on 15 October.

It drew wide attention on 27 October, when Anthropic's Frontier Red Team reported one of its research models had written a working exploit. Against a server with a Multipath TCP (MPTCP) listener, it leaked a kernel address to defeat randomisation, then overwrote a control pointer to run commands as root — 48 minutes to leak the address, five more to gain root. Anthropic has not published the exploit code.

Public proof-of-concept code for the first half of the attack has been available since 29 October. Researcher Marcus Hutchins has reported internet-wide scanning for MPTCP listeners since 2 November, counting about 2.1 million servers reachable over MPTCP on port 443 — which he suspects is a search for this flaw.

No exploitation in the wild has been reported, and the flaw had not joined CISA's Known Exploited Vulnerabilities catalogue as of 7 November. Fixed kernels are available from most major distributions, and Ubuntu's fix has now reached its updates channel. The Go Security Team warns the bug sits in ordinary TCP code, so servers without an MPTCP listener may also be at risk. Patch, reboot, and disable Multipath TCP as a stop-gap if no fixed kernel is available yet.

[Source: threatdefence.com](https://threatdefence.com/article/linux-kernel-tcp-cve-2026-98432-mitigation-hunting) | [Source: kunalvohra.com](https://kunalvohra.com/blog/linux-kernel-cve-2026-98432-how-to-fix)