CVE-2026-98432: A CVSS 9.8 remote use-after-free in the Linux kernel's IPv4 TCP handshake
A critical vulnerability in Linux's TCP implementation allows unauthenticated remote attackers to corrupt kernel memory or crash systems via standard IPv4 traffic.
A critical vulnerability in the Linux kernel’s IPv4 TCP implementation has been patched upstream, but major distributions are still racing to get fixes to their users. CVE-2026-98432 is a use-after-free condition rated CVSS 9.8 that allows an unauthenticated remote attacker to trigger kernel memory corruption or an immediate system crash over standard network traffic, with no local privileges or user interaction required.
The vulnerability exists in code paths that every Linux server runs when accepting IPv4 TCP connections. Specifically, the flaw occurs in tcp_v4_syn_recv_sock() and tcp_v4_send_synack() during concurrent processing of retransmitted TCP connection requests or socket migrations, according to Canonical’s security advisory. A race condition in these paths can free memory that is still being accessed, leading to the use-after-free condition.
The discovery carries an unusual provenance. Anthropic security researcher Xinyang Ge reported the vulnerability, and Atlas Security’s analysis notes that Claude AI reportedly built a working proof-of-concept exploit. If accurate, this would represent a notable case of an AI system contributing directly to offensive security research on a critical infrastructure vulnerability.
Upstream fixes were released between October 11 and October 18, 2026, per Atlas Security’s timeline. However, distribution backporting has lagged. As of October 30, 2026, all supported Ubuntu releases remained vulnerable with fixes still in progress, Canonical confirmed. Red Hat similarly had not shipped patched kernels for RHEL as of late October, despite rating the vulnerability Critical severity because it permits remote kernel memory corruption without authentication.
Red Hat’s CVE entry confirms the attack vector requires only that the target system accept IPv4 TCP connections — something virtually every Linux server does by default. The vulnerability affects all Linux kernels from 4.4 onwards, meaning the affected code has been present for roughly a decade. The combination of remote exploitability, no privilege requirements, and universal exposure makes this among the most serious Linux kernel vulnerabilities disclosed this year, even before considering the reportedly AI-assisted exploit development.