Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions
Summary: A race condition in the Linux kernel's IPv4 TCP connection setup, tracked as CVE-2026-98432, lets an unauthenticated remote attacker read freed memory and potentially run commands as root; the kernel CVE team rates it 9.8 while Red Hat, Oracle and SUSE score it 8.1 and Amazon 7.0. Anthropic said on October 27 that its Claude model wrote a working exploit after initial prompting, leaking a kernel address in 48 minutes and reaching command execution 5 minutes later, and as of October 29 Ubuntu and RHEL had not released fixed kernels.
What you should know: Anthropic's model produced a root exploit for an unpatched kernel bug in under an hour of runtime, and the two largest enterprise Linux vendors still had no fixed kernel to install - with Red Hat stating no available mitigation meets its standards for easy deployment, broad suitability and stability.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-98432
- Related