Anthropic researchers turn a Linux TCP bug into remote root
CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation
CVE-2026-98432 is a use-after-free in the Linux kernel's IPv4 TCP handshake path: a retransmitted SYN can read IP options that another CPU has already freed with plain kfree(). CVSS rates it 9.8, Red Hat 5.9, and Anthropic's Frontier Red Team built a working remote root chain against a server with an MPTCP listener. Patching with the upstream kfree_rcu() fix is the real remedy; disabling MPTCP only narrows exposure.
The reader behaves as though RCU protects the object, but the destructor frees it with ordinary kfree().
- cadamsdotcom
Whoever failed to edit this CVE description down owes us all a bunch of our time back
Everyone using LLMs needs to stop shipping their first draft.
- majorchord
Thankfully the vast majority of servers are not creating MPTCP listeners by default (that I'm aware of).
Not sure why the article doesn't mention it, but you can specifically check for MPTCP listeners using `ss -M`.
- ReDress
I fail to understand / find the gist of this article.
Article describes the technical aspects of the bug, how it got handled by different vendors...AI position on it...
But, one would always ask themselves, why did the author write this article? That part hasn't been clear to me even after going through much of the article.
- drum55
This is a good portion just slop, another 9000 word article that could have been a couple of paragraphs. More text doesn't mean better.
- walrus01
The overlaid HTML popup on that page for "Try The World's First Agentic AI Hacker." tool is cancerous and annoying. This should really be a link to a more reputable link for the CVE in question.
It doesn't appear until you've read the page for maybe 10-15 seconds, so if you're not seeing it, just wait.
It even managed to get past ublock origin, since there's no specific rule for it yet.