CVE-2026-98432 is a Linux TCP use-after-free, and Anthropic's model reached root with it
CVE-2026-98432 is a race in the Linux kernel's handling of IPv4 TCP options, where a retransmitted SYN can free a structure another thread is still reading. The record carries a 9.8 critical CVSS v3.1 vector and stable backports, and Anthropic's write-up names it as the kernel bug behind a zero-click chain that reached a root shell on servers with a multipath TCP listener.