// AI threat desk · 30 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesCriticalCVECVSS 9.8 / 8.1 / 5.9

Linux kernel flaw could let remote attackers run commands as root

CVE-2026-98432 affects Ubuntu, RHEL and other Linux distributions, The Hacker News reported. Anthropic said its model wrote an exploit, while the kernel CVE team rated it 9.8.

· 3 min read
AI-generated image of a security analyst reviewing blurred terminal windows in a dim operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • The Hacker News said CVE-2026-98432 affects Ubuntu, RHEL and other Linux distributions.
  • Anthropic said its model wrote an exploit that lets a remote attacker with no credentials run commands as root on a Linux server with a multipath TCP listener.
  • The Hacker News said the kernel’s CVE team rated the flaw 9.8 out of 10 on the CVSS scale.

A Linux kernel flaw affects Ubuntu, Red Hat Enterprise Linux and other distributions, and Anthropic said its model wrote an exploit that lets a remote attacker without credentials run commands as root. The Hacker News reported the disclosure.

The exploit targets Linux servers with a multipath TCP listener. Anthropic said its model reached command execution in testing, while the kernel’s CVE team rated the flaw 9.8 out of 10 on the CVSS scale.

The flaw is in the Linux kernel’s TCP code. It was introduced in Linux 4.4, and the kernel fix credits Anthropic researcher Xinyang Ge with reporting it.

On this page

The race condition can overwrite a kernel callback pointer

The Hacker News said the bug is a race condition in code that sets up new IPv4 TCP connections. It can make the kernel read memory it has already freed, a flaw known as a use-after-free.

Anthropic said its exploit first made the kernel return extra bytes. A returned kernel address let the attacker bypass KASLR, the kernel’s memory address randomization. The second stage overflowed a buffer and replaced a callback pointer with the address of attacker-controlled payload code, causing the kernel to run a shell command as root.

In Anthropic’s test, leaking a kernel address took 48 minutes and reaching command execution took five more minutes.

Kernel versions contain the fix while distribution packages differ

The Hacker News said the Linux fix is present in the listed stable kernel versions. It said the kernel community does not support cherry-picking individual fixes.

The Hacker News said Red Hat, Amazon, Oracle and SUSE scored the flaw between 5.9 and 8.1. Red Hat’s CVE page rated it Moderate at 5.9 because the race is hard to win, while its machine-readable advisory listed the impact as Important and scored it 8.1.

CERT/CC described a separate denial-of-service path

ZDNet said sustaining that condition required continuous two-way TCP sessions to a reachable and open port. It quoted CERT/CC’s Trent Novelly as saying spoofed IP addresses could not be used for the attacks.

ZDNet said the bug has the identifier CVE-2018-5390 and was dubbed SegmentSmack by Red Hat. Red Hat said that in a worst-case scenario an attacker can stall an affected host or device with less than 2,000 packets per second of attack traffic.

The Hacker News said kernel developers applied a fix on Oct 5, ten days before the CVE was published. It also said the kernel’s CVE team added the 9.8 score to the CVE record on Oct 24.

The Hacker News said Ubuntu and RHEL had not released a fixed kernel as of Oct 29. Red Hat said no effective workaround or mitigation other than a fixed kernel was known at that time.

What to do now

  1. Update to the latest stable kernel.
  2. Where your distribution has released a fixed kernel, install it.

FAQ

What is CVE-2026-98432?

The Hacker News said it is a Linux kernel TCP-code flaw affecting Ubuntu, Red Hat Enterprise Linux and other Linux distributions. It also said the kernel’s CVE team rated it 9.8 out of 10.

Can CVE-2026-98432 run commands as root?

Anthropic said its model wrote an exploit that lets a remote attacker with no credentials run commands as root on a Linux server with a multipath TCP listener.

What did Anthropic’s model do with the Linux flaw?

Anthropic said its model wrote an exploit and reached command execution in testing. The exploit took 48 minutes to leak a kernel address and five more minutes to reach command execution.

How do I fix CVE-2026-98432?

The Hacker News said the Linux fix is included in versions 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. It said Ubuntu and RHEL had not released a fixed kernel as of Oct 29.

How does the Linux kernel flaw work?

The Hacker News said it is a race condition that can make the kernel read memory it has already freed. Anthropic said its exploit used the flaw to leak a kernel address and overwrite a callback pointer before executing a shell command as root.

Sources

  1. Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions, The Hacker News
  2. Linux kernel bug: TCP flaw lets remote attackers stall devices with tiny DoS attack, ZDNet
How we checked this story
ClaimSourceStatus
The Hacker News said the flaw affects Ubuntu, Red Hat Enterprise Linux, and other Linux distributions.The Hacker NewsAttributed
The Hacker News said the Linux kernel’s CVE team rates the flaw 9.8 out of 10 on the CVSS scale.The Hacker NewsAttributed
Anthropic said its AI model wrote an exploit that lets a remote unauthenticated attacker run commands as root on Linux servers with a multipath TCP listener.Anthropic, via The Hacker NewsAttributed
The Hacker News said as of 29 October, Ubuntu and RHEL had not released a fixed kernel.The Hacker NewsAttributed
The Hacker News said red Hat, Amazon, Oracle, and SUSE scored the flaw between 5.9 and 8.1.The Hacker NewsAttributed
The Hacker News said the flaw is a race condition that can make the kernel read memory it has already freed.The Hacker NewsAttributed
The Hacker News said the kernel fix credits Anthropic researcher Xinyang Ge with reporting the bug.The Hacker NewsAttributed
Red Hat’s CVE page rates the flaw Moderate and scores it 5.9.Red Hat, via The Hacker NewsAttributed
Red Hat’s machine-readable advisory file scores the flaw 8.1 and lists its impact as Important.Red Hat, via The Hacker NewsAttributed
The Hacker News said amazon scores the flaw 7.0.The Hacker NewsAttributed
The Hacker News said the bug was introduced in Linux 4.4.The Hacker NewsAttributed
The Hacker News said kernel developers applied a fix on 5 October, ten days before the CVE was published.The Hacker NewsAttributed
The Hacker News said the kernel’s CVE team added the 9.8 score to the CVE record on 24 October, nine days after publishing the CVE.The Hacker NewsAttributed
Anthropic said its exploit took 48 minutes to leak a kernel address and five more minutes to reach command execution.Anthropic, via The Hacker NewsAttributed
Anthropic said the exploit first leaks a kernel address to bypass KASLR and then overwrites a callback pointer to execute a shell command as root.Anthropic, via The Hacker NewsAttributed
Anthropic said the exploit’s second stage overwrites a callback pointer with a payload address, causing the kernel to execute a shell command chosen by the attacker as root.Anthropic, via The Hacker NewsAttributed
The Hacker News said the Linux fix is included in versions 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3.The Hacker NewsAttributed
The Hacker News said the kernel community does not support cherry-picking individual fixes.The Hacker NewsAttributed
CERT/CC said a remote attacker could cause a denial of service with specially modified packets within ongoing TCP sessions.CERT/CC, via ZDNetAttributed
ZDNet said sustaining the denial-of-service condition requires continuous two-way TCP sessions to a reachable and open port.ZDNetAttributed
ZDNet said cERT/CC’s Trent Novelly said the attacks cannot be performed with spoofed IP addresses.ZDNetAttributed
ZDNet said the flaw is identified as CVE-2018-5390 and was dubbed SegmentSmack by Red Hat.ZDNetAttributed
Red Hat said the attack could cause a denial of service with relatively small bandwidth of incoming network traffic.Red Hat, via ZDNetAttributed
Red Hat said an affected host or device could be stalled with less than 2,000 packets per second of attack traffic.Red Hat, via ZDNetAttributed
Red Hat said four attack streams could saturate four CPU cores and delay network-packet processing.Red Hat, via ZDNetAttributed
ZDNet said red Hat confirmed affected systems included RHEL 6 and 7, RHEL 7 for Real Time, RHEL 7 for ARM64, RHEL 7 for IBM POWER, and RHEL Atomic Host.ZDNetAttributed
Red Hat said no effective workaround or mitigation other than a fixed kernel was known.Red Hat, via ZDNetAttributed

Could not verify

  • Whether the flaw has been exploited in the wild is not established.
  • Whether servers without a multipath TCP listener can be taken over the same way is not established.
  • How many systems or organizations are affected is not established.
  • Whether disabling multipath TCP or blocking incoming requests with IP options lowers risk is not established.
anthropiccve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok