A critical Linux networking flaw affects multiple Red Hat Enterprise Linux (RHEL) and Ubuntu releases, with Anthropic reporting a Claude-generated demonstration that ran a root-level command within 53 minutes.
CVE-2026-98432 concerns a use-after-free in IPv4 TCP. It received a 9.8 rating under version 3.1 of the Common Vulnerability Scoring System (CVSS), within the Critical severity band. Anthropic said Claude generated a proof of concept using a socket listening over Multipath TCP (MPTCP). The demonstration exposed a kernel pointer after 48 minutes, then ran a command with root privileges five minutes later.
Red Hat's Nov. 1 errata addressed the flaw in RHEL versions 8, 9 and 10. A related security bulletin still lists all three releases as affected and the response as ongoing. On Nov. 2, Red Hat connected an advisory for NVIDIA software on RHEL 10 to the same kernel issue.
Among Ubuntu's seven affected releases, the main kernel packages for 22.04, 24.04, 26.04 and 26.10 had the status “Vulnerable, work in progress” in an Oct. 30 update. That update also listed versions 16.04, 18.04 and 20.04 as vulnerable. Ubuntu assigned the issue a High priority.
EconoTimes previously covered Intersect's call for Cardano pool operators to update their Linux kernels.
