# Linux kernel CVE-2026-98432: TCP use-after-free rated 9.8, Anthropic says its AI built a remote root exploit · pwn.watch

> CVE-2026-98432 is a race-condition use-after-free in the Linux kernel's IPv4 TCP handshake code (ireq_opt/inet_opt freed without an RCU grace period), fixed upstream on Oct 15 and rated 9.8 by the kernel CNA. On Oct 28 Anthropic said an unreleased Claude model turned the bug into a zero-click remote root exploit against servers running a multipath TCP listener (about 48 minutes to defeat KASLR, five more to get a shell). The exploit was built in a lab and is not known to be used in attacks. Update to a fixed stable kernel.

Page: https://pwn.watch/i/linux-kernel-ipv4-tcp-uaf-cve-2026-98432 · generated 2026-10-28T11:31:58.937Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Linux kernel (IPv4 TCP)
- Started: 2026-10-15
- CVEs: CVE-2026-98432
- Affected: Linux 4.4 and later stable branches before the fixed releases below
- Fixed in: 5.10.272; 5.15.223; 6.1.190; 6.6.159; 6.12.113; 6.18.56; 7.2.10; 7.3

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/linux-kernel-ipv4-tcp-uaf-cve-2026-98432/feed.xml
- JSON Feed: https://pwn.watch/i/linux-kernel-ipv4-tcp-uaf-cve-2026-98432/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/linux-kernel-ipv4-tcp-uaf-cve-2026-98432.json
- This file: https://pwn.watch/i/linux-kernel-ipv4-tcp-uaf-cve-2026-98432/llms.txt

## Updates (newest first)
- 2026-10-28: Anthropic's Frontier Red Team says an unreleased Claude model chained the bug into a zero-click remote root exploit on servers with a multipath TCP listener; the CVE record itself describes an IPv4 TCP fix, and only Anthropic's post links the two. (https://www.anthropic.com/research/discovering-vulnerabilities-with-claude)
- 2026-10-15: Fix ("ipv4: free inet_opt and ireq_opt after an RCU grace period") lands upstream and CVE-2026-98432 is published, rated 9.8 by the kernel CNA. (https://nvd.nist.gov/vuln/detail/CVE-2026-98432)

## Fix brief
# Security brief: Linux kernel CVE-2026-98432: TCP use-after-free rated 9.8, Anthropic says its AI built a remote root exploit

Source: https://pwn.watch/i/linux-kernel-ipv4-tcp-uaf-cve-2026-98432 · status: live · severity: critical · updated Oct 28, 2026, 08:46 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
CVE-2026-98432 is a race-condition use-after-free in the Linux kernel's IPv4 TCP handshake code (ireq_opt/inet_opt freed without an RCU grace period), fixed upstream on Oct 15 and rated 9.8 by the kernel CNA. On Oct 28 Anthropic said an unreleased Claude model turned the bug into a zero-click remote root exploit against servers running a multipath TCP listener (about 48 minutes to defeat KASLR, five more to get a shell). The exploit was built in a lab and is not known to be used in attacks. Update to a fixed stable kernel.

Severity detail: CVSS 9.8 (kernel CNA); remote, no auth. Anthropic reports a lab-built root exploit; no known in-the-wild exploitation, not in CISA KEV.

- Product: Linux kernel (IPv4 TCP)
- CVE / advisory ids: CVE-2026-98432

## Affected versions
- Linux 4.4 and later stable branches before the fixed releases below

## Check whether you're affected
Run these where the product is installed or in the project that depends on it, then compare with the affected/fixed versions:

```sh
uname -r
```

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 5.10.272
- 5.15.223
- 6.1.190
- 6.6.159
- 6.12.113
- 6.18.56
- 7.2.10
- 7.3

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
Check the running kernel with `uname -r` and compare to the fixed stable releases; install your distro's kernel update and reboot. Debian, Ubuntu, openSUSE and Azure Linux track this CVE.

## Latest updates
- Oct 28, 2026: Anthropic's Frontier Red Team says an unreleased Claude model chained the bug into a zero-click remote root exploit on servers with a multipath TCP listener; the CVE record itself describes an IPv4 TCP fix, and only Anthropic's post links the two.
- Oct 15, 2026: Fix ("ipv4: free inet_opt and ireq_opt after an RCU grace period") lands upstream and CVE-2026-98432 is published, rated 9.8 by the kernel CNA.

## Advisories
- [NVD: CVE-2026-98432](https://nvd.nist.gov/vuln/detail/CVE-2026-98432) (NVD)
- [OSV: CVE-2026-98432 (fixed versions)](https://osv.dev/vulnerability/CVE-2026-98432) (OSV.dev)
- [Linux stable fix commit](https://git.kernel.org/stable/c/11a03ce3c4a62d84c10ccdfe47f8075006498568) (kernel.org)

## Write-ups & news
- [Discovering and exploiting vulnerabilities in critical, real-world software with Claude](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude)
- [Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits](https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html)

---
Machine-readable: https://pwn.watch/i/linux-kernel-ipv4-tcp-uaf-cve-2026-98432.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.