Red Hat rates the Linux kernel flaw that Anthropic's model turned into a remote root exploit “Critical”, while Ubuntu's main releases are still unpatched

The flaw is CVE-2026-98432, a use-after-free bug in the Linux kernel's IPv4 TCP code. It is the Linux bug that, Anthropic said on 27 October, one of its unreleased models turned into a remote root exploit; the Switchboard ran that account on 29 October. What is new is the vendors' response.

Red Hat published security bulletin RHSB-2026-016 on 30 October and rates the flaw Critical. It lists Red Hat Enterprise Linux 8, 9 and 10 and OpenShift as affected and says: “Red Hat is expediting the release of fixes.” Until they arrive, it offers an nftables rule that drops incoming IPv4 TCP packets carrying IP options, and warns that the rule is not a substitute for patching.

Ubuntu's security tracker, updated on 30 October, lists its releases, among them 22.04 LTS and 24.04 LTS, as vulnerable with fixes in progress, and gives the flaw a CVSS score of 9.8.

The Hacker News reported that the kernel fix landed upstream on 5 October and that Debian, Oracle Linux and some Amazon Linux and SUSE kernels already have fixes. It said Red Hat's CVE page had rated the flaw Moderate, 5.9, as of 29 October. BleepingComputer reported that Go 1.24 and later turn on Multipath TCP by default for TCP listeners on Linux, so some servers may run the exposed setup without their administrators knowing. No exploitation outside the lab has been reported.

• Confirmed Red Hat rates the flaw Critical, lists RHEL 8, 9 and 10 and OpenShift as affected, and says it is expediting fixes. Red Hat, RHSB-2026-016
• Confirmed Ubuntu lists 22.04 LTS and 24.04 LTS as vulnerable with work in progress, priority High, CVSS 9.8. Ubuntu security tracker
• Reported The kernel fix landed upstream on 5 October, and Debian, Oracle Linux and some Amazon Linux and SUSE kernels are fixed, The Hacker News reported. The Hacker News
• Reported Go 1.24 and later enable Multipath TCP by default on Linux, and no exploitation in the wild has been confirmed, BleepingComputer reported. BleepingComputer