CVE-2026-98432: Linux kernel IPv4 TCP use-after-free rated 9.8; AI-written root exploit demoed, Ubuntu and RHEL unpatched, CIQ mitigation issued
A race condition in the Linux kernel's IPv4 TCP connection setup path, tracked as CVE-2026-98432, allows a use-after-free when IP options stored with a pending request are handed to a new socket without being copied. The kernel CVE team scored it 9.8 CVSS (low attack complexity, both sides of the race attacker-induced), while Red Hat (5.9 Moderate on its CVE page, 8.1/Important in its machine-readable advisory; it classifies the issue as a potential denial of service because the race is complex to exploit, per bleepingcomputer.com), Oracle, SUSE (8.1) and Amazon (7.0) score it lower. Anthropic disclosed on October 27 that its Claude model (an unreleased model, per bleepingcomputer.com) wrote a working exploit achieving unauthenticated remote root on Linux servers running a multipath TCP (MPTCP) listener, taking about 53 minutes. The flaw also affects ordinary TCP connections, although RCE has not been publicly demonstrated on servers without an MPTCP listener (bleepingcomputer.com). The bug was introduced in Linux 4.4, fixed upstream on October 5 and credited to Anthropic researcher Xinyang Ge. As of October 30, Ubuntu 22.04, 24.04, 26.04 LTS and 26.10 and RHEL 8, 9 and 10 had not shipped fixed kernels, and no in-the-wild exploitation was reported (bleepingcomputer.com). RHEL 7 is not affected because its kernel lacks the vulnerable code, and Rocky Linux 8, 9 and 10 are affected (bleepingcomputer.com). Ubuntu published its advisory on October 15 and updated it on October 29, framing the impact as crashes and service disruption without claiming a reliable remote exploit or active exploitation (gbhackers.com).
Entenda a falha
A vulnerabilidade
CVE-2026-98432 is a race condition leading to a use-after-free in the Linux kernel's IPv4 TCP connection setup, present since Linux 4.4. An attacker needs only network reach to a TCP service, with no credentials. The kernel CVE team scores it 9.8, assuming a connection request with IPv4 Record Route or Timestamp options. Impact is kernel memory disclosure, corruption or a crash, and Anthropic says its exploit gives unauthenticated remote root on servers with an MPTCP listener. BleepingComputer says RCE has not been publicly shown without MPTCP. Red Hat rates it 5.9 Moderate on its CVE page and 8.1 Important in its advisory file, Oracle and SUSE 8.1, Amazon 7.0. Fixed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. IPv6 and RHEL 7 are not affected. Ubuntu and RHEL 8, 9 and 10 had no fixed kernel as of October 30; Rocky Linux 8, 9 and 10 are affected.
Como funciona
During the TCP handshake, the kernel keeps the IP options of the incoming connection request with the pending request. When the connection completes, it hands those options to the new child socket by reference instead of copying them. Meanwhile another CPU may handle a retransmitted SYN for the same request and build the SYNACK reply, reading the options under an RCU read lock and reading the options length twice. If the child socket is destroyed first, the options are freed and the other CPU reads freed memory. A lost race only fails that one connection, so attempts can be repeated. A related race exists in request socket migration, where cloned request sockets share the options.
Por que é vulnerável
The root cause is a lifetime error: the IPv4 path shares the options between the pending request and the child socket without copying them, and frees them with ordinary kfree() while RCU readers may still use them. The overlap became possible once request sockets stopped running under the listener lock (commit 079096f103fa). IPv6 copies the options, so it is not affected. The fix switches to kfree_rcu(), so reclamation waits for existing readers. The articles do not say why it went unnoticed since 4.4.
Onde está
Per the kernel advisory quoted by BleepingComputer and the Ubuntu advisory reported by gbhackers: tcp_v4_syn_recv_sock() (the ireq->ireq_opt handoff), tcp_check_req(), tcp_v4_send_synack(), inet_csk_route_req(), ip_build_and_send_pkt() and ip_options_build() on the reader side, and inet_sock_destruct() and tcp_v4_reqsk_destructor() where the fix applies kfree_rcu().
Como foi descoberta
The kernel fix credits Anthropic researcher Xinyang Ge with reporting the bug. Kernel developers applied the fix on October 5 and the CVE was published on October 15, the same day Ubuntu issued its advisory. The kernel CVE team added its 9.8 score on October 24. On October 27 Anthropic published a post saying an unreleased Claude model wrote an exploit after initial prompting. The CVE record and the fix do not mention MPTCP; that link comes only from Anthropic's post. No exploitation in the wild was reported as of October 30.
PoC pública
Anthropic's October 27 post describes a working exploit written by its Claude model: a two-stage chain that leaks a kernel address to defeat KASLR, then overwrites a callback pointer to run a command as root, against a server with an MPTCP listener. It reportedly took about 53 minutes in testing. The post does not include exploit code, the kernel version or the test configuration, so this is a described demonstration, not a public tool. Given that repeated attempts are possible, defenders should not wait on the lower vendor scores; patch, or use CIQ's temporary filtering of IPv4 TCP packets with IP options.
Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 19:16.
Detalhes técnicos
During the TCP handshake, when a connection completes the kernel passes the IP options from the pending request to the new socket by reference. If that socket is destroyed while another CPU is still using those options to answer a retransmitted SYN, the kernel reads freed memory. IPv6 is unaffected because options are copied. The kernel CVE team's scenario involves sending a connection request carrying IPv4 Record Route or Timestamp options and retransmitting it to win the race, leading to kernel memory disclosure, corruption or crash. Anthropic's two-stage exploit first leaks a kernel address to defeat KASLR, then overflows a buffer to overwrite a callback pointer with an attacker-staged payload, executing a shell command as root. A lost race only fails that connection, allowing repeated attempts; in testing the leak took 48 minutes and code execution 5 more. No exploit code, kernel version or test configuration was published.
At code level, tcp_v4_syn_recv_sock() transfers ownership of the request socket's ireq->ireq_opt pointer to the child socket without copying, while another CPU may build a SYNACK for a retransmitted SYN via tcp_check_req(), tcp_v4_send_synack() and inet_csk_route_req() under an RCU read lock; ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice (bleepingcomputer.com). Because inet_sock_destruct() frees inet_opt with ordinary kfree(), concurrent readers can touch freed memory inside ip_options_build(). The overlap became possible once request sockets stopped running under the listener lock (commit 079096f103fa). A related race affects request socket migration when net.ipv4.tcp_migrate_req=1 or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is in use, since cloned request sockets temporarily share ireq_opt (gbhackers.com).
MPTCP is not typically enabled by default, but since Go 1.24 the runtime enables MPTCP by default on Linux TCP listeners when the kernel supports it, so some Go network services may expose MPTCP listeners without administrators knowing (bleepingcomputer.com). macOS is not affected because it uses the XNU kernel (bleepingcomputer.com).
Remediação
Install fixed vendor kernels where available (Debian, Oracle Linux, SUSE, Amazon Linux have shipped at least some fixed packages). Debian fixed it in 6.1.190-1 (Bookworm, Debian 12) and 6.12.113-1 (Trixie, Debian 13), with fixed packages also in testing and unstable (bleepingcomputer.com). Self-built kernels should move to 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 or 7.3; the kernel CVE team recommends updating to the latest stable kernel rather than cherry-picking. The upstream fix replaces immediate deallocation with kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor(), deferring reclamation until existing RCU readers finish (gbhackers.com). Ubuntu (including cloud, FIPS and real-time kernels) and RHEL have no fix yet, with Red Hat stating fixes are deferred to a future update and that no mitigation meets its deployability standards. Ubuntu's tracker lists generic kernels for 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS plus older releases and multiple cloud variants as vulnerable with fixes in progress; listed target builds should not be mistaken for released security updates (gbhackers.com).
Where patches are unavailable, restrict access to trusted networks or IPs. Rocky Linux support provider CIQ recommends temporarily blocking IPv4 TCP packets containing IP options before they reach the vulnerable TCP code and published example nftables rules; it cautions that disabling MPTCP alone is insufficient because the bug can still be triggered via ordinary TCP traffic (bleepingcomputer.com).
Linha do tempo
-
Linux kernel CVE-2026-98432 TCP use-after-free: Anthropic AI exploit gives remote root on MPTCP servers; Ubuntu and RHEL unpatched
BleepingComputer adds CIQ's interim mitigation (nftables rules blocking IPv4 TCP packets with IP options, with a warning that disabling MPTCP alone is insufficient), the fact that Go 1.24+ enables MPTCP listeners by default, the confirmed Debian fixed versions, the affected status of Rocky Linux 8/9/10 and RHEL 8/9/10 (RHEL 7 unaffected), and that Ubuntu remained vulnerable as of October 30.
ler a análise desta fonte ocultar
BleepingComputer adds CIQ's interim mitigation (nftables rules blocking IPv4 TCP packets with IP options, with a warning that disabling MPTCP alone is insufficient), the fact that Go 1.24+ enables MPTCP listeners by default, the confirmed Debian fixed versions, the affected status of Rocky Linux 8/9/10 and RHEL 8/9/10 (RHEL 7 unaffected), and that Ubuntu remained vulnerable as of October 30.
A critical use-after-free in the Linux kernel's IPv4 TCP code, tracked as CVE-2026-98432 (9.8 from the Linux kernel CVE team), allows unauthenticated remote code execution as root on servers with a Multipath TCP (MPTCP) listener. Researchers at Anthropic reported that an unreleased Claude model built an exploit that bypassed KASLR and ran arbitrary commands as root in about 53 minutes. The flaw also affects ordinary TCP, although RCE has not been publicly demonstrated without an MPTCP listener. Red Hat rates it only 5.9 (potential denial of service) because the race is hard to win. Fixes exist upstream and in some distributions, but Ubuntu and RHEL remained unpatched as of October 30, and no in-the-wild exploitation has been confirmed.
Technical Details
The bug is a race in which
tcp_v4_syn_recv_sock()handsireq->ireq_optto the child socket (newinet->inet_opt) without copying it. Another CPU can process a retransmitted SYN and send a SYNACK viatcp_check_req(),tcp_v4_send_synack()andinet_csk_route_req()underrcu_read_lock()only, after whichip_build_and_send_pkt()andip_options_build()readopt->optlentwice. A similar issue occurs during request socket migration whennet.ipv4.tcp_migrate_reqis enabled or aBPF_SK_REUSEPORT_SELECT_OR_MIGRATEprogram is used. Affected kernels date back to 4.4. MPTCP is not normally enabled by default, but since Go 1.24 the runtime enables MPTCP on Linux TCP listeners when the kernel supports it, so some Go services may expose MPTCP listeners unknowingly. macOS (XNU) is not affected, and RHEL 7 is not affected because it lacks the vulnerable code.Remediation
Install updated kernel packages as distributions release them. Debian fixed the flaw in 6.1.190-1 (Bookworm) and 6.12.113-1 (Trixie), and Oracle Linux, Amazon Linux and SUSE have fixed some kernel versions. Ubuntu 22.04, 24.04, 26.04 LTS and 26.10 remain vulnerable with fixes in progress, and RHEL 8, 9 and 10 plus Rocky Linux 8, 9 and 10 are affected with fixes pending. Where no patch exists, restrict access to trusted networks or IPs. CIQ recommends temporarily dropping IPv4 TCP packets carrying IP options with nftables rules, and warns that disabling MPTCP alone is insufficient because ordinary TCP can still trigger the bug.
-
Ubuntu advisory details CVE-2026-98432 Linux kernel IPv4 TCP use-after-free; generic kernels still unpatched
Adds Ubuntu's own advisory timeline (published October 15, updated October 29, 2026) and precise code-level detail: the faulty ownership transfer in tcp_v4_syn_recv_sock(), the kfree() in inet_sock_destruct() racing RCU readers in ip_options_build(), the role of commit 079096f103fa, and a second race in request socket migration with net.ipv4.tcp_migrate_req=1 or BPF_SK_REUSEPORT_SELECT_OR_MIGRATE. It also specifies the upstream fix (kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor()) and names the Ubuntu releases still awaiting fixes (26.10, 26.04 LTS, 24.04 LTS, 22.04 LTS generic plus cloud variants). Ubuntu's framing emphasizes crash/DoS impact and does not confirm a reliable remote exploit.
ler a análise desta fonte ocultar
Adds Ubuntu's own advisory timeline (published October 15, updated October 29, 2026) and precise code-level detail: the faulty ownership transfer in tcp_v4_syn_recv_sock(), the kfree() in inet_sock_destruct() racing RCU readers in ip_options_build(), the role of commit 079096f103fa, and a second race in request socket migration with net.ipv4.tcp_migrate_req=1 or BPF_SK_REUSEPORT_SELECT_OR_MIGRATE. It also specifies the upstream fix (kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor()) and names the Ubuntu releases still awaiting fixes (26.10, 26.04 LTS, 24.04 LTS, 22.04 LTS generic plus cloud variants). Ubuntu's framing emphasizes crash/DoS impact and does not confirm a reliable remote exploit.
Ubuntu published and then updated (October 15 and October 29, 2026) an advisory for CVE-2026-98432, a use-after-free in the Linux kernel's IPv4 TCP connection handling rated 9.8 CVSS. The flaw stems from
tcp_v4_syn_recv_sock()transferring ownership of IP options from a request socket'sireq->ireq_optto a child socket without copying, while another CPU may still read those options when building a SYNACK for a retransmitted SYN. Ubuntu's description notes crashes and service disruption but does not claim a reliable remote exploit or active exploitation. Ubuntu's tracker lists generic kernels for 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS as vulnerable with fixes still in progress, along with older releases and several cloud kernel variants.Technical Details
inet_sock_destruct()freesinet_optwith plainkfree(), so concurrent RCU readers inip_options_build()— reached viatcp_check_req(),tcp_v4_send_synack()andinet_csk_route_req()— can touch freed memory. The overlap became possible once request sockets stopped being handled under the listener lock (commit 079096f103fa). A related race affects request socket migration whennet.ipv4.tcp_migrate_req=1or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is used, since cloned request sockets briefly shareireq_opt.Remediation
The upstream fix replaces immediate deallocation with
kfree_rcu()ininet_sock_destruct()andtcp_v4_reqsk_destructor(), deferring reclamation until RCU readers finish. Ubuntu users should track the advisory and not mistake listed target builds for released security updates. -
CVE-2026-98432: Linux kernel IPv4 TCP use-after-free rated 9.8; AI-written root exploit demoed, Ubuntu and RHEL unpatched
ler a análise desta fonte ocultar
A race condition in the Linux kernel's IPv4 TCP connection setup path, tracked as CVE-2026-98432, allows a use-after-free when IP options stored with a pending request are handed to a new socket without being copied. The kernel CVE team scored it 9.8 CVSS (low attack complexity, both sides of the race attacker-induced), while Red Hat (5.9 Moderate on its CVE page, 8.1/Important in its machine-readable advisory), Oracle, SUSE (8.1) and Amazon (7.0) score it lower. Anthropic disclosed on October 27 that its Claude model wrote a working exploit achieving unauthenticated remote root on Linux servers running a multipath TCP (MPTCP) listener. The bug was introduced in Linux 4.4, fixed upstream on October 5 and credited to Anthropic researcher Xinyang Ge. As of October 29, Ubuntu and RHEL had not shipped fixed kernels and no in-the-wild exploitation was reported.
Technical Details
During the TCP handshake, when a connection completes the kernel passes the IP options from the pending request to the new socket by reference. If that socket is destroyed while another CPU is still using those options to answer a retransmitted SYN, the kernel reads freed memory. IPv6 is unaffected because options are copied. The kernel CVE team's scenario involves sending a connection request carrying IPv4 Record Route or Timestamp options and retransmitting it to win the race, leading to kernel memory disclosure, corruption or crash. Anthropic's two-stage exploit first leaks a kernel address to defeat KASLR, then overflows a buffer to overwrite a callback pointer with an attacker-staged payload, executing a shell command as root. A lost race only fails that connection, allowing repeated attempts; in testing the leak took 48 minutes and code execution 5 more. No exploit code, kernel version or test configuration was published.
Remediation
Install fixed vendor kernels where available (Debian, Oracle Linux, SUSE, Amazon Linux have shipped at least some fixed packages). Self-built kernels should move to 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 or 7.3; the kernel CVE team recommends updating to the latest stable kernel rather than cherry-picking. Ubuntu (including cloud, FIPS and real-time kernels) and RHEL have no fix yet, with Red Hat stating fixes are deferred to a future update and that no mitigation meets its deployability standards. Advisories do not state whether disabling MPTCP or blocking inbound packets carrying IP options reduces risk.