Linux Kernel TCP Flaw With CVSS 9.8 Score Lets Attackers Run Commands as Root Remotely

Affiliate disclosure: We may earn a commission from qualifying purchases through these links at no additional cost to you. As an Amazon Associate I earn from qualifying purchases.

The Linux kernel is facing a critical TCP vulnerability that, according to reporting from The Hacker News on 2026-10-29, can let attackers execute commands as root remotely on affected servers. The flaw, tracked as CVE-2026-98432, is described as a use-after-free race condition in the kernel’s TCP code that specifically targets servers with a multipath TCP listener. The Linux kernel CVE team assigned it a CVSS score of 9.8, indicating maximum severity, while some vendors rated it lower based on their view of how difficult the race condition is to exploit. Source: The Hacker News, “Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions” (2026-10-29).

What the flaw is

The issue is a use-after-free race condition in Linux TCP code. Based on the source findings, the practical impact is remote root command execution on systems exposed through multipath TCP listeners. That makes the vulnerability especially serious for servers where that listener is enabled and reachable over the network. Source: The Hacker News (2026-10-29).

Why the severity rating is disputed

The Linux kernel’s CVE team assigned CVE-2026-98432 a 9.8 CVSS score, but the reporting says Red Hat and Amazon applied lower scores, ranging from 5.9 to 8.1, because of their assessment of how hard the race condition is to exploit. That gap does not change the existence of the flaw, but it does show that vendors did not fully agree on how exploitable it is in practice. Source: The Hacker News (2026-10-29).

AI played a role in exploit generation

One notable detail from the report is that Anthropic said its Claude AI model was able to generate a working exploit for the flaw. The source does not say that Claude discovered the vulnerability, only that it was able to produce an exploit. That distinction matters: the evidence supports AI-assisted exploit generation, not AI-originated discovery. Source: The Hacker News (2026-10-29).

Patch status across Linux distributions

According to the report, Debian, Oracle Linux, SUSE, and Amazon Linux had already released fixes at the time of publication. Ubuntu and RHEL were still working on patched kernels. Those details suggest the vulnerability was actively being addressed across major distributions, but the source does not say all affected systems were protected by publication time. Source: The Hacker News (2026-10-29).

Bottom line

CVE-2026-98432 is a serious Linux kernel TCP bug with potentially severe consequences on systems using multipath TCP listeners. The reported CVSS 9.8 score reflects the risk as seen by the Linux kernel CVE team, while vendor ratings show some disagreement about exploitability. The added detail that Claude could generate a working exploit underscores how quickly modern tooling can turn a kernel bug into an operational threat. Source: The Hacker News (2026-10-29).

Sources and dates

Research completed: 2026-11-02T05:10:00Z

Building your own website?

This separate resource is for readers creating an online business: Explore Systeme.io. It is an affiliate link, not an Amazon product recommendation.