Hacking News
Critical Linux kernel TCP flaw (CVE-2026-98432) enables remote root code execution
A race condition in the Linux kernel's IPv4 TCP implementation can trigger a use‑after‑free before authentication, allowing an unauthenticated attacker to leak kernel memory, corrupt memory or crash the system. Anthropic reported that its Claude model created a working exploit that executed attacker‑chosen commands as root on servers with a Multipath TCP listener, completing in about 53 minutes and not being publicly released. The vulnerability has a CVSS score of 9.8 and affects kernels from version 4.4 onward. Fixed versions include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Ubuntu and Red Hat Enterprise Linux had not issued patches as of October 29, while Debian, Oracle Linux, Amazon Linux and SUSE have released fixes for some branches.