Update: This follows my post on Anthropic’s unreleased model chaining real exploits.
What’s new
The Linux root bug now has a number: CVE-2026-98432. It’s a race in the IPv4 TCP connection-setup code that causes a use-after-free. The kernel CVE team scores it 9.8. Red Hat, Amazon, Oracle and SUSE score it 5.9 to 8.1. Anthropic says its model got unauthenticated remote root on servers with a multipath TCP (MPTCP) listener. The fix credits Anthropic’s Xinyang Ge and is backported upstream.
The catch: as of Oct 29, Debian, Oracle Linux, SUSE and Amazon Linux have shipped fixed kernels for at least some versions. Ubuntu (including cloud, FIPS and real-time kernels) and RHEL have not.
What I’d do
- Patch the minute your distro ships a kernel, then reboot.
- Until then, check whether anything listens on MPTCP (my how-to in this batch shows how) and don’t expose services you don’t need.
God Bless, and Needs Garlic!
