CVE-2026-98432: critical Linux TCP flaw still unpatched on some major distros

CVE-2026-98432, a critical flaw in the way the Linux kernel sets up TCP network connections, remains the subject of a patching race as of Monday, November 2, 2026. The bug was fixed in the main Linux kernel code in early October and the vulnerability record was published on October 15. Debian, SUSE and Oracle have shipped fixed kernels and AlmaLinux put patched kernels into testing on October 30, but security write-ups found that Ubuntu's own tracker still listed its kernels as vulnerable, and reports on Red Hat's status disagreed. The search term is trending in the United Kingdom after Anthropic, the US artificial intelligence company, said on October 27 that an unreleased research version of its Claude model had written a working attack that turns the bug into full control of some servers.

Linux is the operating system behind a great many servers and cloud machines, including those that start-ups and public bodies rent. A flaw in the TCP code sits in the part of the operating system that answers every incoming connection, so it does not depend on which website or application a company runs on top. That is why the kernel team put the score at 9.8: in the worst case, an attacker on the internet with no account could crash a machine or corrupt its memory.

Two terms help explain the risk. A "use-after-free" bug happens when a program keeps using a piece of memory after it has handed it back; if an attacker can place their own data in that memory at the right moment, they may steer what the program does next. A "race condition" means the attack only works if two things happen in a precise order, which is why such bugs are often hard to exploit reliably. Anthropic's claim is that its model won that race repeatedly: first to leak a kernel memory address and defeat a protection called address-space layout randomisation, then to overwrite a pointer and run a chosen command with the highest privileges.

The claim has drawn attention because it suggests AI tools can now turn a published bug into a working attack quickly. It remains a company's own account. Anthropic has not released the code, the kernel version or the configuration it tested, and one independent kernel team said it had not been able to reproduce the result. Security write-ups also disagree on whether the attack needs MPTCP, an extension that lets one connection use several network paths at once: Anthropic's demonstration used an MPTCP listener, but the bug itself is in ordinary IPv4 TCP, and Go's security team has said machines without MPTCP may face similar attacks.

Peepals timeline: the kernel fix was committed on October 5; the CVE was published on October 15; Anthropic described its exploit on October 27; AlmaLinux published patched kernels for testing on October 30; and on October 31 write-ups still listed Ubuntu kernels as vulnerable. Our calculation from the reported dates: 22 days passed between the upstream fix and the exploit claim, and by October 31, 26 days after the fix, write-ups still found no fixed Ubuntu kernel.

Short-term: System administrators need to check which kernel each machine is actually running, not only whether an update has been downloaded, because a new kernel only protects a machine after it reboots into it. Interim steps described in write-ups, such as dropping IPv4 packets that carry IP options or turning off MPTCP where it is not used, reduce exposure but are not described as a full fix.

Long-term: The episode adds pressure on distributions to shorten the time between an upstream kernel fix and a shipped package, and on regulators to plan for faster attack development if AI models can write exploits within hours of a disclosure.

Who is affected: Companies, start-ups, universities and government bodies running Linux servers that accept TCP connections from the internet, especially on Ubuntu or Red Hat Enterprise Linux, and cloud customers who manage their own virtual machines.

Questions and Answers