CVE-2026-98432: Linux IPv4 TCP use-after-free and the MPTCP exploit claim
A concrete example of a kernel memory-safety bug and a high-impact exploit chain reported by Anthropic: the CVE is real and fixed upstream, while the reported remote-root proof of concept is specifically for MPTCP listeners and remains unpublished. It is a timely reminder to distinguish an upstream fix from distro rollout and a vulnerability from a demonstrated attack path.
CVE-2026-98432 is a Linux IPv4 TCP use-after-free race: the kernel can transfer IPv4 option data to a child socket while another CPU is still reading it during a retransmitted SYN/SYN-ACK path. The Linux kernel CVE team assigns CVSS 3.1 9.8 (Critical) and identifies upstream fixes across maintained stable branches. The fix uses kfree_rcu() so the option memory is not released until RCU readers have finished.
Anthropic reports that an unreleased internal Claude research model produced a remote-root exploit for Linux servers with a Multipath TCP (MPTCP) listener. Its proof of concept took 48 minutes to leak a kernel pointer and another five minutes to reach command execution, according to Anthropic. This is the vendor's account: the exploit code, exact tested kernel/configuration, and broader reproducibility details are not public. The report does not establish that every vulnerable Linux server is remotely exploitable by this same chain. The CVE itself and the upstream fix are independently documented by the kernel CVE team and source commit; NVD displays the CNA's severity score and says NIST has not provided its own assessment.
The linked Atlas article summarized distribution status as of October 31, 2026. Kernel versions and distro backports change over time, so operators should check their distribution's current advisory and installed kernel rather than treating that snapshot or an upstream version number as definitive. The Ubuntu tracker is one example; the kernel CVE team recommends updating to a fixed kernel rather than cherry-picking a standalone change.