Ubuntu and Red Hat finally patch a critical Linux kernel flaw

It took 53 minutes. That is how long an unreleased internal AI model reportedly needed, according to Anthropic, to write an attack that gains root privileges on a Linux server, remotely and without a password. The company made the claim on October 27. The targeted flaw is CVE-2026-98432. As of October 30, Ubuntu and Red Hat, two of the most widely used distributions in business, had not yet released any patched kernel.

The bug is a use-after-free: the kernel reads a memory area it has just freed. It sits in the code that handles the opening of TCP connections over IPv4. It can be triggered with a connection request carrying “IP options,” a rarely used field in the packet header. The flaw has existed since Linux 4.4. Kernel developers fixed it on October 5, then published the CVE on October 15. On October 24, they rated it 9.8 out of 10.

A rating that divides vendors

Not everyone shares that assessment. Red Hat first rated the flaw “moderate” (5.9), considering that it was mostly useful for crashing a machine. According to TuxCare, the vendor raised it to 8.1 on October 29, the level used by Oracle, SUSE and Amazon. Its advisory now shows 9.8 and classifies the flaw as “critical,” values it describes as preliminary. Anthropic's demonstration covers one specific case: a server that accepts MPTCP (Multipath TCP) connections, an extension of TCP that uses several network paths at once. According to BleepingComputer, no one has publicly shown code execution on a server without MPTCP.

That case is less rare than it seems. Also according to BleepingComputer, programs written in Go from version 1.24 onward enable MPTCP by default when the kernel supports it. Some services may therefore use it without their administrators knowing. Anthropic has published neither the attack code nor the configuration it tested, and TuxCare says no independent reproduction was known as of October 30. No exploitation by attackers has been reported, and the flaw is not in the known exploited vulnerabilities catalog of the US agency CISA.

Who already has a patched kernel?

• Debian: fixed in kernels 6.1.190-1 (Debian 12) and 6.12.113-1 (Debian 13).
• SUSE, Oracle Linux (UEK), Amazon Linux: patches released for some versions.
• Ubuntu: 22.04, 24.04, 26.04 and 26.10 remain vulnerable, with fixes “in progress.” Versions 16.04, 18.04 and 20.04 are listed as vulnerable.
• Red Hat Enterprise Linux 8, 9 and 10, as well as Rocky Linux: affected and not yet patched. RHEL 7 is not affected. AlmaLinux offers patched kernels in its testing repository.
• For the upstream kernel, the fixed versions are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3.

What to do in the meantime?

Disabling MPTCP is not enough: according to BleepingComputer, ordinary TCP traffic can also trigger the bug. AlmaLinux and TuxCare suggest rejecting incoming TCP packets that carry IP options:

nft add table ip cve_2026_98432
nft add chain ip cve_2026_98432 prerouting '{ type filter hook prerouting priority -300; }'
nft add rule ip cve_2026_98432 prerouting meta l4proto tcp ip hdrlength != 5 drop

This rule disappears on reboot. AlmaLinux notes that traffic between containers on the same machine may bypass it, and TuxCare says it has not tested it. Also check whether MPTCP is active with sysctl net.mptcp.enabled. If you don't need it, disable it and list the services listening on it with ss -lnMp. Finally, restrict access to exposed servers to trusted addresses only.

None of this replaces the patch: you will need to install the new kernel and then reboot. The question now is when Ubuntu and Red Hat will release it.

Update of November 13, 2026

Both distributions have partly caught up on CVE-2026-98432, the Linux kernel flaw rated 9.8 out of 10. On October 27, Anthropic, the maker of Claude, said that one of its unreleased internal research models had written an exploit allowing a remote attacker, without credentials, to run commands on Linux servers running a Multipath TCP (MPTCP) service. Red Hat released a patched kernel for RHEL 10 on November 1 (advisory RHSA-2026:93413, version 6.12.0-211.72.1.el10_2). According to the site PBX Science, advisories RHSA-2026:93412 and RHSA-2026:93414, published the same day, fix RHEL 9 (5.14.0-687.64.1.el9_8) and RHEL 8 (4.18.0-553.182.1.el8_10). An advisory dated November 3 also covers RHEL 8.4 extended support (RHSA-2026:94623). As of November 2, again according to PBX Science, the RHEL 9 real-time kernel, RHEL for NVIDIA and the RHEL CoreOS images used by OpenShift were still listed as vulnerable.

Ubuntu states on its advisory page, updated on November 11, that the main kernel is fixed in four of its versions: 22.04 (5.15.0-203.213), 24.04 (6.8.0-149.149), 26.04 (7.0.0-43.43) and 26.10 (7.3.0-10.10). The kernels for AWS, Azure, Google Cloud and Oracle are fixed too. Fixes remain “in progress” for 16.04, 18.04 and 20.04, as well as for the generic FIPS-certified kernel and the HWE kernels (newer, optional) of 22.04 and 24.04. Other variants, including the Raspberry Pi one in 26.04 and some NVIDIA variants, are not yet fixed either.

In all cases, you must reboot the machine for the patched kernel to take effect. Red Hat notes that the firewall rule suggested in the meantime reduces exposure without preventing it entirely, and that it must be removed once the update is installed.