TL;DR
CVE-2026-98432 is a critical use-after-free (UAF) vulnerability in the Linux kernel's IPv4 TCP handshake path, affecting kernel versions 4.4 and later. The flaw involves a race condition that can lead to kernel memory corruption and potentially remote code execution. Anthropic's Frontier Red Team reported that an unreleased internal Claude research model discovered the vulnerability and developed a working exploit capable of executing arbitrary commands as root on a Linux server with an accessible Multipath TCP (MPTCP) listener, without authentication or user interaction.
AWS independently acknowledged the vulnerability and confirmed that remote code execution is possible under specific conditions. Anthropic reported that its proof of concept took approximately 53 minutes to progress from a remote kernel address leak to command execution. Upgrade to a vendor-patched kernel and reboot to fully remediate the vulnerability. As of the latest AWS advisory reviewed on November 3, 2026, AWS reported no known exploitation in the wild.
Affected Software and Versions
Affected software: Linux Kernel
CVE-2026-98432 affects Linux kernel versions 4.4 and later, including the following stable kernel branches:
| Kernel Branch | Affected Versions | Fixed Version |
|---|---|---|
| Linux 5.10 | ≤ 5.10.271 | 5.10.272 |
| Linux 5.15 | ≤ 5.15.222 | 5.15.223 |
| Linux 6.1 | ≤ 6.1.189 | 6.1.190 |
| Linux 6.6 | ≤ 6.6.158 | 6.6.159 |
| Linux 6.12 | ≤ 6.12.112 | 6.12.113 |
| Linux 6.18 | ≤ 6.18.55 | 6.18.56 |
| Linux 7.2 | ≤ 7.2.9 | 7.2.10 |
| Linux 7.3 mainline | Pre-7.3-rc7 | 7.3-rc7 |
These version ranges are based on the Linux kernel security advisory. Kernel versions from 4.4 onward on older or unsupported branches may also be vulnerable.
Affected distributions: Potentially affected Linux distributions include Ubuntu, Debian, Red Hat Enterprise Linux (RHEL), SUSE Linux Enterprise, Oracle Linux, and Amazon Linux. Actual exposure and remediation status depend on the distribution, kernel package, and vendor-specific backported patches.
Note: Distribution-provided kernel versions may contain fixes without matching the upstream version numbers listed above. Check the relevant vendor security advisory before determining whether a system is vulnerable.
How to Mitigate CVE-2026-98432
The recommended remediation for CVE-2026-98432 is to install a patched Linux kernel and reboot the affected system. According to AWS, applying the kernel update is the only complete remediation, although supported livepatch solutions can also address the vulnerability without requiring an immediate reboot.
Amazon Linux: AWS has released patched kernel packages for Amazon Linux 2 and Amazon Linux 2023, covering multiple kernel branches. Administrators should update affected instances to the latest available security-patched kernel.
Kubernetes and AWS-managed environments: Organizations running workloads on Amazon EKS, ECS, Fargate, or Bottlerocket should ensure that their underlying worker nodes and compute environments are running patched kernel versions. This includes managed and self-managed node groups, EC2 instances, and existing workloads that may continue running on vulnerable infrastructure.
Distribution-Specific Updates: Administrators should consult their Linux distribution's official security advisories for the latest patch availability and remediation guidance. The Ubuntu Security Tracker lists affected releases and tracks fixes, while the Red Hat CVE advisory provides affected product details and available security errata. Additional guidance is available from the Debian Security Tracker and SUSE Security. Since patch status varies by distribution and release, verify your system's status with the relevant vendor and install the applicable security update.
Upstream Linux Kernel: For systems running custom or upstream kernels, the vulnerability has been addressed in Linux 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, and 6.18.56. Administrators should upgrade to the corresponding patched release or a newer supported kernel version.
Organizations should prioritize identifying all affected systems, including cloud instances, container hosts, and Kubernetes worker nodes, to ensure that vulnerable kernel versions are not left running in their environments.
For additional details, refer to the official AWS Security Bulletin and the Linux Kernel security announcement.
How to Mitigate CVE-2026-98432 If You Cannot Patch Immediately
If an immediate kernel upgrade is not possible, several temporary mitigations can reduce exposure to CVE-2026-98432. These measures do not replace installing a patched kernel and rebooting.
Disable Multipath TCP (MPTCP): If MPTCP is not required, disable it by setting the kernel parameter net.mptcp.enabled=0. This reduces exposure to the demonstrated exploitation path, which relies on an accessible MPTCP listener.
Disable MPTCP in Go Applications: Go 1.24 and later enable MPTCP by default for listening sockets on Linux where supported. For Go applications, setting GODEBUG=multipathtcp=0 disables this default behavior at runtime. However, applications that explicitly enable MPTCP may override this setting, so it should not be treated as a system-wide mitigation.
Block IPv4 Packets Containing IP Options: The vulnerability involves the handling of IP options during the IPv4 TCP handshake. As a temporary mitigation, AWS recommends dropping incoming packets with IPv4 header options using an iptables rule: iptables -I INPUT 1 -m u32 --u32 '0>>24&0x0f=6:15' -j DROP
This rule filters incoming packets with IPv4 headers longer than the standard 20-byte header. However, it may interfere with legitimate traffic that relies on IPv4 options, and the rule does not automatically persist across reboots. Administrators should also account for traffic paths that bypass the host's INPUT chain, such as forwarded traffic to containers.
Restrict Direct Network Exposure: Where possible, place affected systems behind a properly configured load balancer or managed service that terminates incoming connections before they reach the vulnerable host. Restrict unnecessary inbound access and ensure that the host's TCP services are not directly reachable from untrusted networks.
Important: These mitigations reduce exposure but do not fully remediate CVE-2026-98432. Prioritize installing the vendor-provided kernel patch and rebooting affected systems as soon as possible.
CVE-2026-98432 Severity Ratings and CVSS Scores
CVE-2026-98432 has received different severity assessments from Linux kernel maintainers and major vendors, with scores ranging from 5.9 to 9.8.
-
Linux Kernel CVE Team
9.8(Critical): Classified as remotely exploitable over the network, requiring no privileges or user interaction, with low attack complexity. -
Ubuntu
8.3(High): Assigns a high severity rating, emphasizing the significant impact on system availability, with lower confidentiality and integrity impacts. -
Oracle and SUSE
8.1(High): Assess the vulnerability similarly but consider exploitation more complex. -
Amazon (AWS)
7.0(High): Assigns a lower numerical severity score and classifies the issue as Important. -
Red Hat
5.9(Moderate): Takes a more conservative approach, considering successful exploitation more difficult and a kernel crash a more likely outcome than remote code execution.
The variation in scores reflects differences in how vendors assess race-condition reliability, exploitation complexity, and potential impact. Despite these differences, the vulnerability deserves attention because successful exploitation could compromise the affected Linux system.
Technical Deep Dive: Root Cause and Exploitation of CVE-2026-98432
CVE-2026-98432 is a race condition leading to a use-after-free (UAF) vulnerability in the Linux kernel's IPv4 TCP handshake implementation. The issue occurs when multiple CPUs concurrently process TCP connection events and access IP options memory whose ownership has changed or whose allocation has already been freed. The vulnerability affects kernel versions dating back to Linux 4.4.
A Race Condition in TCP Connection Handling
When a TCP connection begins, the client sends a SYN packet to the server. If the packet contains IPv4 options, the Linux kernel stores those options alongside the pending connection request so they can be used while processing the handshake and constructing the SYN-ACK response.
The problem arises when the connection progresses while the kernel is simultaneously processing a retransmitted SYN for the same request. During successful connection establishment, tcp_v4_syn_recv_sock() transfers ownership of the IP options buffer from the request socket to the newly created child socket without copying the underlying memory.
Meanwhile, another CPU can still be processing the retransmitted SYN and reading those options through the TCP response path. Because these operations can occur concurrently, the child socket may be destroyed and its IP options memory freed while another execution path still holds a reference to that memory.
Understanding the Use-After-Free
The underlying issue is a mismatch between how the kernel accesses shared memory and how it releases that memory.
The relevant code paths use Read-Copy-Update (RCU) read-side protection when accessing the IP options. RCU allows readers to access shared data concurrently, but memory must not be reclaimed until existing readers have finished using it.
In the vulnerable implementation, inet_sock_destruct() releases the options buffer using kfree(), which does not wait for an RCU grace period. Consequently, another CPU can continue accessing the buffer after it has been freed. Subsequent operations in ip_options_build() may then read memory that is no longer valid.
A related race can occur when TCP request-socket migration is enabled, including configurations that use net.ipv4.tcp_migrate_req or a BPF SO_REUSEPORT migration program. In this case, request sockets can share the same options buffer, creating another opportunity for one execution path to free memory that another path is still accessing.
Exploitation and Security Impact
An unauthenticated remote attacker can potentially trigger the vulnerable code by sending crafted IPv4 TCP packets containing IP options to an affected listening service. Exploitation depends on specific timing conditions and successfully winning the race between connection processing and memory deallocation.
The immediate consequences can include kernel memory disclosure, memory corruption, and a system crash. More seriously, Anthropic's Frontier Red Team demonstrated a proof of concept that progressed from a remote kernel memory disclosure to control-flow manipulation and arbitrary command execution as root on a Linux server with an accessible Multipath TCP (MPTCP) listener. The demonstrated exploit required no authentication or user interaction.
The demonstrated attack used two stages. First, it exploited the race to disclose kernel memory and obtain a kernel pointer, helping defeat Kernel Address Space Layout Randomization (KASLR). Second, it exploited the memory-corruption condition to overwrite a callback pointer and redirect execution through existing kernel functionality, ultimately executing an attacker-controlled command with root privileges.
Importantly, the MPTCP listener is a requirement of the demonstrated remote code execution exploit, not necessarily of the underlying vulnerability. The underlying use-after-free exists in the IPv4 TCP handshake code and can have security consequences even where the specific demonstrated exploit path is unavailable.
How the Vulnerability Was Fixed
The upstream fix addresses the unsafe memory deallocation rather than changing the TCP handshake itself. The kernel patch replaces the relevant kfree() calls with kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor().
Unlike a direct kfree(), kfree_rcu() defers reclamation until an RCU grace period has elapsed, allowing existing readers to finish accessing the memory before it is released. This resolves the lifetime-management issue responsible for the use-after-free condition. The fix has been incorporated into patched upstream kernel releases and backported to maintained stable branches.
References
The following resources provide additional technical details, vulnerability disclosures, security advisories, and remediation guidance for CVE-2026-98432.
-
NIST National Vulnerability Database (NVD): CVE-2026-98432
-
Anthropic: Discovering Vulnerabilities with Claude
-
Amazon Web Services (AWS): Security Bulletin 2026-160
-
Linux Kernel CVE Team: CVE-2026-98432 Security Announcement
-
Ubuntu Security: Ubuntu CVE-2026-98432 Tracker
-
Red Hat: CVE-2026-98432 Security Advisory
-
Debian Security Tracker: CVE-2026-98432
-
Aikido Security: Linux Kernel TCP RCE Vulnerability – CVE-2026-98432
