CVE-2026-98432 is a Linux TCP use-after-free, and Anthropic's model reached root with it

CVE-2026-98432 brings together three things that do not usually arrive in the same week: a kernel race that has been patched and backported, a record NVD still marks as received rather than analysed, and a public write-up describing a working root shell. The severity and the exploit claim come from different places.

What the record says

NVD published the CVE on 15 October and the status still reads “Received”, meaning NVD’s own analysis is unfinished. That is not the same as having no score. The record already carries a CVSS v3.1 base score of 9.8, critical, marked as a secondary metric: network attack vector, low complexity, no privileges or user interaction, high impact throughout. Secondary means it is the supplying CNA’s vector rather than NVD’s own judgement.

The description is the kernel commit message. “tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it.” Because “request sockets are processed without holding the listener lock”, another CPU handling “a retransmitted SYN for the same request socket” can free the child while a SYNACK is being built, “leading to a use-after-free in ip_options_build()”. The fix is in the commit title: free the options after an RCU grace period, with kfree_rcu() in the destructors instead of a plain free. The commit is e3f33b0a1d89d738e2b913dab519226eaf76e15b, and NVD’s references carry a stable backport for each maintained branch, with the earliest unaffected release listed at 5.10.272.

The precondition, and a migration variant

The commit describes a second path with the same shape: request socket migration, which it names as net.ipv4.tcp_migrate_req=1 or “a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program”. With either in play, a cloned request socket can share the options structure with the original, and the same free can land while another CPU is still reading it. That is a configuration precondition, not a claim about every Linux host.

IPv6 gets a precise answer. “IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options.” The migration variant does have an IPv6 counterpart, but the commit says it “is only set by CALIPSO” and will be “addressed in a separate patch”.

The exposure Anthropic describes is narrower again: its exploit targets “Linux servers with a multipath TCP listener”. A host running no such listener is not in that picture, however high the score reads.

How it surfaced

Anthropic published its account on 27 October and revised it on 30 October. It describes using “an unreleased, internal research model” to find critical vulnerabilities in widely used software, and sharing “five attack chains, which led to remote code execution and other critical impacts with little to no user interaction”. Only the Linux chain matters here, and Anthropic names this CVE directly: after an initial prompt, the model wrote an exploit letting a remote attacker send packets to a server with a multipath TCP listener and run arbitrary commands as root, “without any credentials or user interaction”.

The write-up splits the work into defeating KASLR and then hijacking control flow, and notes a property that makes the race less forbidding than it sounds: “a lost race only fails the handshake without crashing the whole system, so a determined attacker can retry indefinitely until they succeed”. In its own proof of concept, leaking a kernel pointer took 48 minutes and reaching shell execution took another five. Those are Anthropic’s measurements on its own exploit, not a general estimate of attack time.

The Go detail, and what to do

LWN reports that on 29 October the Go security team advised that “all programs written in Go use multipath TCP by default, so many systems may be unknowingly vulnerable”. That is LWN’s account of the advisory, not the advisory itself, so treat it as reported. If it holds for your estate, servers you never counted as multipath TCP users may be listening anyway.

No exploit code appears here and nothing collected shows public exploitation. The action is the ordinary one for a kernel bug with backports: take your distribution’s kernel when it ships one containing the fix, and treat “patched upstream” as done only when the running kernel says so. Anthropic says the vulnerability was “patched upstream and backported to all maintained stable kernel branches”, and NVD’s references carry the stable commits to check against. LWN’s advice is plainer still: users “may be wise to update to a patched kernel as soon as one becomes available for their distribution”.

If you run a multipath TCP listener, or Go services on hosts you had not counted as listening, take this patch this week. If you are unsure which you have, that question comes first.