TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 (atlasum.net)

A critical vulnerability (CVE-2026-98432) was recently discovered in the Linux kernel concerning a use-after-free flaw during the IPv4 TCP handshake process. This bug, rated CVSS 9.8, allows remote, unauthenticated attackers to exploit systems running vulnerable kernels (from version 4.4 onward), potentially leading to memory corruption or crashes. Linux distributions, including Red Hat and Ubuntu, are reportedly still vulnerable and have not yet rolled out fixes, which is particularly alarming given that the flaw resides in code that all Linux servers execute when accepting IPv4 TCP connections. The significance of this vulnerability is heightened by its potential for exploitation, as demonstrated by Anthropic's Claude model, which successfully crafted a remote root exploit that runs without credentials on servers with multipath TCP listeners. The underlying technical issue was addressed by modifying memory management in the kernel to prevent premature freeing of memory still in use. As many servers remain unpatched, the urgency for immediate updates cannot be overstated, particularly for organizations running critical infrastructure, which places them at heightened risk of denial-of-service attacks or unauthorized access.