A use-after-free in the Linux kernel's IPv4 TCP handshake carries a 9.8 CVSS score from the kernel's own CVE team, and the two distributions most South African server fleets run have not shipped a fixed kernel. Anthropic says its model wrote a working exploit that reached root on a server running a multipath TCP listener.

What happened

The bug is a race in the code that completes a new IPv4 TCP connection. When a connection completes, the kernel hands the IP options stored on the pending request to the child socket without copying them. If a retransmitted SYN is processed on another CPU while that socket is torn down, the kernel reads memory it has already freed.

It was introduced in Linux 4.4 and fixed upstream on 5 October 2026, with the fix included in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. The kernel CVE team applied its 9.8 score to CVE-2026-98432 on 24 October, treating attack complexity as low because both sides of the race are attacker-induced.

Vendors disagree on severity. Red Hat's CVE page rates it moderate at 5.9 with a likely kernel crash, while its own machine-readable advisory rates it important at 8.1, and Oracle and SUSE also score 8.1. Amazon scores 7.0. As of 29 October, no vendor advisory, the CVE record or Anthropic's post reported attacks using the flaw.

Who is affected

• Ubuntu 22.04, 24.04, 26.04 and 26.10 LTS and interim releases, where the fixed kernel is still work in progress with nothing released.
• Ubuntu 16.04, 18.04 and 20.04, listed as vulnerable with no fix, and RHEL 8, 9 and 10 plus OpenShift 4, where Red Hat has deferred the fix.
• Self-built kernels older than the fixed releases above, on any host that accepts TCP connections from untrusted networks.
• Servers exposing a multipath TCP listener, which is the configuration Anthropic's exploit targeted.

What to do now

Patch where a fixed kernel package exists, and put Ubuntu and RHEL hosts on a watch list with a reboot window booked. Red Hat states that no available mitigation meets its standards for being deployable and stable.

• Debian, Oracle Linux, SUSE Linux Micro and openSUSE Leap 16, and Amazon Linux 2023 on the 6.18 and 6.12 kernel packages have fixed builds published.
• On Ubuntu and RHEL, track the distribution's CVE page and apply the kernel update the day it lands, then actually reboot.
• Reduce the window by keeping management and application ports off the public internet where a VPN or reverse proxy will do.
• Confirm whether any service on your servers requests multipath TCP; if nothing needs it, that removes the demonstrated exploit path.

What this means for South African businesses

Almost no SME in this market runs MPTCP deliberately, so the working root chain Anthropic demonstrated needs a configuration most local servers do not have. The practical exposure here is narrower than the 9.8 suggests, and calling it a crisis would be wrong.

What does matter is the development cost: an AI model produced a functioning remote kernel exploit, and the leak stage took 48 minutes. A kernel memory corruption bug on a shared virtualisation host is still a downtime and blast-radius problem for a small provider, so the kernel update deserves a maintenance window rather than the usual wait.

Source: The Hacker News, with vendor status as published on 29 October 2026.

Also on the blog

• FNB fined R1 million after one access-control slip exposed 88 home loan files to 696 clients
• 319 Chrome extensions with 13.4 million installs hijacked search traffic

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.