---
type: "post"
id: "linux-s-october-2026-tcp-use-after-free-749743"
slug: "linux-s-october-2026-tcp-use-after-free-749743"
title: "Linux's October 2026 TCP Use-After-Free: CVE-2026-98432"
description: "Atlas reports that Linux vulnerability CVE-2026-98432 has fixes in several upstream branches and that Red Hat shipped patched RHEL 8, 9, and 10 kernels on November 1, while Ubuntu still listed its kernels as vulnerable at the time of its check."
retrieval_nugget: "Atlas reports that Linux vulnerability CVE-2026-98432 has fixes in several upstream branches and that Red Hat shipped patched RHEL 8, 9, and 10 kernels on November 1, while Ubuntu still listed its kernels as vulnerable at the time of its check."
published_at: "2026-11-02"
updated_at: "2026-11-02"
record_date: "2026-11-02"
date_kind: "published_at"
topics: ["anthropic","claude"]
entities: ["Anthropic","Linux","Red Hat","Ubuntu","Claude","CVE-2026-98432"]
related_patterns: []
novelty_label: "new_fact"
what_changed: "Adds the detailed patch and distribution status: stable fixes shipped, Red Hat issued fixed kernels, while Ubuntu still marked all releases vulnerable as of Nov. 1."
prior_refs: ["memory:33d19740-75f4-82d1-a77d-44340881a5bf","memory:9e0d5198-0fc8-883d-a3e2-77ea7c9b74cb"]
source_url: "https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf"
source_urls: ["https://atlasum.net/blog/cve-2026-98432-linux-ipv4-tcp-uaf"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:linux-s-october-2026-tcp-use-after-free-749743"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/linux-s-october-2026-tcp-use-after-free-749743/","markdown":"https://newruntime.com/posts/linux-s-october-2026-tcp-use-after-free-749743.md","json":"https://newruntime.com/posts/linux-s-october-2026-tcp-use-after-free-749743.json"}
---

# Linux's October 2026 TCP Use-After-Free: CVE-2026-98432

## Retrieval answer

Atlas reports that Linux vulnerability CVE-2026-98432 has fixes in several upstream branches and that Red Hat shipped patched RHEL 8, 9, and 10 kernels on November 1, while Ubuntu still listed its kernels as vulnerable at the time of its check.

## Summary
Atlas reports that Linux vulnerability CVE-2026-98432 has fixes in several upstream branches and that Red Hat shipped patched RHEL 8, 9, and 10 kernels on November 1, while Ubuntu still listed its kernels as vulnerable at the time of its check. For teams operating Linux infrastructure, the immediate question is the status of their distribution kernel—not merely whether upstream released a fix.

## What happened
Atlas describes CVE-2026-98432 as a use-after-free involving IPv4 option data during the TCP handshake. The Linux kernel CNA assigned CVSS 3.1 9.8, Critical. The report says the flaw dates back to Linux 4.4 and can affect kernels that lack the fix. It identifies remote unauthenticated reachability and cites possible kernel-memory disclosure, corruption, or a crash in the CNA’s scoring notes. Red Hat’s bulletin additionally says an attacker could trigger remote code execution through a race condition during TCP connection-request processing.

The upstream fixes were released across several kernel lines: 7.2.10 and 6.18.56 on October 11; 6.12.113, 6.6.159, 6.1.190, 5.15.223, and 5.10.272 on October 15; and 7.3 on October 18. Atlas cautions that distributions backport fixes and keep their own version numbering, so upstream version numbers alone are not a reliable way to determine whether a system is protected. The report says IPv6 connections are not affected by the main issue.

Anthropic researcher Xinyang Ge reported the flaw, according to Atlas. The report says Anthropic claims Claude produced a working proof-of-concept exploit that can run commands as root on Linux servers with a multipath TCP listener, without credentials. Anthropic had not published that exploit at the time of the report. Atlas notes that Go programs open multipath TCP listeners by default, per the Go Security Team; this does not establish that every Go service is exploitable or that an attacker can reach a listener in a given deployment.

Distribution status in the report is time-bounded: it reflects checks as of 6:15 PM CST on November 1, 2026. Red Hat had shipped fixed kernels for RHEL 8, 9, and 10 on November 1, while some RHEL-derived or related products were still listed as affected. Ubuntu’s tracker listed its kernel as vulnerable on every release, with work in progress for several releases. Atlas also reports fixes for Debian 12 and 13 and certain SUSE products, while AlmaLinux fixes were in testing rather than production repositories. Operators should consult their vendor’s current advisory for their exact product and kernel package.

## What the archive adds
[Red Hat rates the Claude-found Linux kernel flaw Critical, with fixes still pending](https://newruntime.com/posts/red-hat-rates-claude-found-linux-kernel-ipv4-fbe9d2/) covered the same CVE one day earlier. This report adds a distribution-status update: RHEL 8–10 fixes had shipped by November 1, while Ubuntu still listed its kernels as vulnerable at the time of Atlas’s check. It is a new fact on a known story, not a new vulnerability.

## Trend signal
This item does not materially support a SITE_PATTERNS thesis: it concerns a kernel vulnerability and patch status, not a demonstrated shift in agent architecture or capability. The use of Claude to produce a claimed exploit is notable, but the source does not provide the PoC or evidence sufficient to establish a broader trend.

## Why now
The relevant timing is operational: Atlas’s November 1 check followed upstream fixes released in October and Red Hat’s November 1 kernel shipments. Its Ubuntu status is also explicitly time-stamped, so it should not be treated as a current status without checking the vendor tracker again. The gap between an upstream fix and each distribution’s shipped package is the practical reason this remains a live operational item.

## Why it matters
For infrastructure teams, the practical work is asset and kernel inventory followed by vendor-advisory checks and patch deployment. A container image update will not change the host kernel, and distro backports mean a package may contain a fix without matching the upstream version string. Conversely, an upstream fixed release does not prove that a managed instance or distribution has received it. The report’s severity and claimed exploit make it reasonable to prioritize checking exposure, especially where multipath TCP listeners are enabled, while avoiding the assumption that the unpublished PoC is already circulating or that all Linux hosts are equally exposed.

Teams building AI services often run their application stack in containers, on managed Kubernetes, or on cloud images. Those deployment choices can obscure who owns the kernel update and whether a node has actually been rebooted into it. The useful response is therefore operational rather than speculative: identify the host operating system and kernel package, determine whether the service accepts applicable IPv4 TCP traffic, and use the distribution or platform provider’s advisory as the authoritative package-status source. This is also a reminder that application-level controls do not remove a kernel-level patch obligation.

## What happens next
- **More affected distributions will publish or update package advisories for this CVE.** (3 months, 80%). Watch for: vendor tracker changes and production-repository kernel releases.
- **Operators will need to validate installed kernel versions after patch deployment, including host reboots where required.** (3 months, 75%). Watch for: fleet inventory showing the patched vendor package as the running kernel.

## Limits and uncertainty
The exploit claim is attributed to Anthropic and is not independently demonstrated in the supplied source; the PoC is unpublished. The report does not establish that exploitation is occurring in the wild, quantify affected hosts, or show that every system with a multipath TCP listener is exploitable. Distribution statuses are a snapshot from November 1 and can change. Vendor kernels may backport fixes under different package versions, while product-specific configurations and support status can alter exposure. The source also does not provide enough detail to assess exploit reliability or the precise conditions needed beyond the stated listener requirement.

The source is a secondary public report that aggregates vendor and kernel information. It should not be used to infer the present status of Ubuntu, RHEL-related products, or any cloud platform after its stated observation time. It also does not say whether a particular managed service exposes customers to the vulnerable host kernels.

## Skill to build now
Add host-kernel verification to the incident checklist for containerized AI services. This week, make one inventory that maps each production workload to its host distribution, running kernel package, patch owner, and reboot status. Then compare that inventory with the relevant vendor advisory rather than relying on an application image tag or an upstream Linux version alone. The same practice helps when a critical issue lands below the container boundary.

## Reader takeaway
Treat this as a prompt to verify your fleet, not as a substitute for vendor advisories. Check the exact distribution kernel and product status, prioritize applicable fixes, and remember that container updates do not replace host-kernel patching. The headline exploit remains a claim about an unpublished PoC, not proof of widespread exploitation.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)