Claude wrote a working remote root exploit for a critical Linux TCP bug that Ubuntu and RHEL still haven't patched
TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
CVE-2026-98432 is a use-after-free in Linux's IPv4 TCP handshake, reachable by any unauthenticated remote peer and scored CVSS 9.8 by the kernel CNA. The upstream fix is a two-line switch to kfree_rcu, shipped in stable kernels from October 11 to 18, but as of October 29 Ubuntu lists every release as vulnerable and RHEL 8, 9, and 10 have no fix. Anthropic says its Claude model produced a proof-of-concept that runs commands as root on servers with a multipath TCP listener.
A lost race only fails the handshake without crashing the whole system, so a determined attacker can retry indefinitely until they succeed.
- asveikau
> TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
I know it's customary for HN to edit titles to remove extraneous information, but removing "Linux" here really takes away something useful and relevant. This is a Linux vulnerability. If you're running *BSD or Mac or Windows, not affected.
- peanut-walrus
Some notes I've got about this:
- MPTCP is not a requirement, it is a generic use-after-free.
- Exploitability over the internet is unlikely, most ISP routers drop packets with IP options fields.
- At least according to Red Hat, dropping packets with IP options yourself helps, but is not a full mitigation.
- Successful exploit requires multiple CPU cores to process packets, so systems with just a single core or packet processing pinned to a single core are not affected.
- swinglock
How are Ubuntu and RHEL not fixed? Few operating systems market themselves more as suitable for servers. What are they doing over there?
- teekert
I've been compiling a list of cybersecurity RSS feeds to build a small automation (with oversight from Hermes agent) to ping me (ntfy.sh or just Telegram) when a CVE requires my intervention (matching them to a list of services I run for clients and myself.)
My list (of feeds) is still small, but this CVE did not show up, do any of you have any tips for RSS feeds to use for this purpose?
- grey-area
No patches for Ubuntu or red hat yet.
- Shank
At least if you’re on Amazon Web Services behind a load balancer you probably aren’t really that impacted enough to spend Halloween patching.
> AWS Web Application Firewall, Application Load Balancer, Classic Load Balancer, TLS Listeners on Network Load Balancer, Cloud Front, API Gateway
> Customers using the above services do not receive TCP connections from untrusted sources directly when following best practices. AWS is applying updates to the underlying infrastructure of these services and no immediate customer action is required if you are using these services. We still recommend customers update their self-managed instances behind these services within the next 30 days.
[0]: https://aws.amazon.com/security/security-bulletins/2026-160-...
- 9cb14c1ec0
I suppose I'm not the only one feeling worn out by this tidal wave of vulnerabilities that I somehow have to keep up to?
- winwang
It's okay guys, the authors simply don't know how to write good C. A real C programmer would not have shipped such a basic use-after-free bug. Rust is just a crutch.