CVE-2026-98432: blocking the Linux TCP bug until Ubuntu and Red Hat ship a fix (getrff.com)

A critical vulnerability, CVE-2026-98432, in the Linux kernel's IPv4 TCP handshake has been identified, receiving a significant CVSS score of 9.8. The flaw stems from a use-after-free issue that could allow an attacker to gain root access without credentials on servers utilizing multipath TCP (MPTCP) listeners. Although Anthropic's red team successfully developed a working exploit for this vulnerability, they have not released it, and there are currently no reported instances of its exploitation in the wild. The bug has existed since kernel version 4.4, but an upstream fix is available in recent kernel updates, which some distributions like Debian, Oracle Linux, and SUSE have already implemented. However, distributions like Ubuntu and Red Hat have yet to release their patches, leaving many systems at risk. To mitigate the potential threat until official fixes are deployed, experts recommend applying a specific nftables rule to block any TCP packets with IPv4 options that could trigger the vulnerability. This proactive measure is particularly pertinent for systems with MPTCP listeners, as the risk is heightened in such environments. Users are encouraged to verify the status of their current kernel version against changelogs and to employ temporary fixes through network filtering while awaiting the official updates from their respective Linux distributions. This incident highlights the critical nature of maintaining timely security updates in the Linux ecosystem, especially as AI-driven explorations into vulnerabilities become increasingly sophisticated.