Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions (thehackernews.com)

A critical flaw in the Linux kernel's TCP code, identified as CVE-2026-98432, has been assigned a high severity score of 9.8 on the CVSS scale and affects major distributions including Ubuntu and Red Hat Enterprise Linux (RHEL). This vulnerability allows unprivileged remote attackers to execute commands as root on servers with multipath TCP (MPTCP) enabled, creating significant security risks. The underlying bug is a race condition that leads to a use-after-free issue during the TCP handshake, potentially allowing attackers to read freed memory and exploit system weaknesses. The significance of this incident is amplified by the fact that Anthropic's AI model, Claude, demonstrated the ability to exploit this vulnerability, highlighting the complexities of AI-generated security threats. While a kernel fix has been applied upstream and backported, many distributions, including Ubuntu and RHEL, have yet to implement it as of late October. This situation emphasizes the urgent need for users to monitor their systems for updates, as the flaw remains unpatched in several key environments, leaving them open to potential exploits that could compromise system integrity.