Summary of the Linux Kernel Vulnerability CVE-2026-98432

What happened

On October 15, 2026, the Linux kernel CNA (the group that issues vulnerability IDs for the Linux kernel) published CVE-2026-98432. The bug is in how the kernel handles TCP connections over IPv4. After the kernel frees some IP option data from a connection request, another CPU core can still read it. No login is needed. Anyone who can send packets to a server that accepts connections can try it. Anthropic found and reported the bug. On October 27, its research report said it had shown remote root command execution using this bug.

Key numbers and facts

• CVSS 3.1 base score: 9.8 (Critical), given by the Linux kernel CNA
• CWE-825 (Expired Pointer Dereference), assigned by Red Hat
• Not on the CISA KEV list (as of October 29, 2026)
• Affected: Linux kernel 4.4 and later, before the fixed versions. Versions before 4.4 are not affected.
• Upstream fixed versions: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3

How the attack path works

The main path starts with a TCP SYN packet (the first step of connecting) that carries IPv4 Record Route or Timestamp options. The kernel saves those options on a connection request. A second SYN for the same request then makes the kernel build a SYNACK reply on another CPU core. While that happens, the connection can be set up and torn down, and the child socket is freed. The reply code then reads the freed memory. The CNA says freed memory that gets reused could leak kernel data to the attacker, allow writes outside the intended area, or crash the kernel. A second path uses socket migration, which is turned on by a setting called net.ipv4.tcp_migrate_req=1 or a BPF program. The fix changes the kernel to free this memory with kfree_rcu(), which waits until all readers are done. IPv6 is not covered by the first path.

Why the scores differ

The CNA's 9.8 score was not in the first October 15 notice. The first notice listed only 4 fixed versions. By October 30, the notice and CVE record listed 8 fixed versions and the 9.8 score. Most distributors rate it 8.1 (High) instead. The gap comes from one setting: the CNA rates attack complexity as Low, while SUSE, Oracle, Amazon, and Red Hat rate it as High. Ubuntu shows 9.8 for CVSS 3 and 8.3 for CVSS 4.0.

Why it matters

Anthropic says its proof of concept worked against a Linux server with an MPTCP (multipath TCP) listener. It first leaked a kernel address, which breaks a defense called KASLR, and then ran a chosen shell command as root. The PoC took 48 minutes to leak the address and 5 more minutes to run the command. A failed race only breaks the handshake and does not crash the system, so an attacker can retry.Servers should check their distribution's update status and install the fixed kernel as soon as possible.