Report · atlasum.net
TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
atlasum.net
Source published October 31, 2026
Summary: 2 min read
67/100
Summary
Linux stable kernels released fixes in October 2026 for CVE-2026-98432, a critical use-after-free vulnerability in IPv4 TCP connection handling. The flaw affects kernels from Linux 4.4 onward that lack a distributor backport or an upstream fix, and can be reached remotely without authentication during the TCP handshake, before an application processes the connection. The Linux kernel CNA assigned a CVSS 3.1 score of 9.8; potential consequences include kernel-memory disclosure, memory corruption, crashes, and possible remote code execution. Fixed upstream versions include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. The patch replaces immediate memory freeing with RCU-delayed freeing so concurrent kernel readers cannot access released IPv4 option data. As of October 31, Ubuntu listed all releases as vulnerable and RHEL 8, 9, and 10 had no fix, while Debian, specified SUSE releases, Oracle UEK, and Amazon Linux had released fixes. Anthropic says its Claude model produced an unpublished proof-of-concept that executes commands as root on Linux servers with MPTCP listeners. Go programs running on Linux enable MPTCP by default for listen sockets from Go 1.24 where the kernel permits it. Administrators can reduce exposure by installing a vendor-fixed kernel and rebooting; temporary mitigations include filtering IPv4 TCP packets with IP options and disabling unused MPTCP listeners.
Key Takeaways
- CVE-2026-98432 is a remotely reachable, unauthenticated Linux IPv4 TCP use-after-free vulnerability with a CVSS 3.1 score of 9.8 from the Linux kernel CNA.
- Linux fixed the flaw in stable releases 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3.
- Anthropic says an unpublished Claude-generated proof of concept achieved root command execution against Linux servers with MPTCP listeners.
- A kernel update requires a reboot before the vulnerability fix becomes active, including on container hosts and Kubernetes nodes.
- Filtering incoming IPv4 TCP packets carrying IP options reduces exposure but does not repair the vulnerable kernel or fully prevent exploitation.
What the discussion said
The AI angle drew a more measured reaction than the alarmist framing around a critical kernel bug. One practitioner reported that AI is already genuinely useful for static vulnerability hunting in firmware binaries: it can surface suspicious code paths faster than manual review. But that usefulness stopped well short of autonomous compromise. When asked to turn findings into root access, the tool reportedly wandered because a use-after-free is not automatically an exploit; practical exploitation often needs heap control, information disclosure, reliable read/write primitives, and defenses such as ASLR to be overcome. The thread treated that gap as an important reality check on claims of push-button offensive AI. Several commenters also pushed back on the idea that AI itself created this vulnerability wave. Their view was that AI may accelerate discovery of long-buried flaws, producing an exhausting spike in disclosures without changing the fact that the bugs already existed. That could eventually improve the security baseline, provided operators survive the patching burden and adopt containment-minded designs. The mood was wary rather than triumphalist: AI-assisted discovery can expose dangerous defects faster, but exploit development remains target-specific and technically demanding.
Where opinion split
The sharpest dispute was whether AI-driven vulnerability discovery is mainly a net security gain or the beginning of an unmanageable defensive crisis. Optimists argued that faster discovery flushes out old defects and ultimately hardens systems; skeptics accepted that premise but stressed that organizations may face overwhelming remediation pressure before those benefits arrive.
Coverage & discussions
Hacker News · atlasum.net
Community discussions
Community Sentiment
Positives
- AI-assisted static analysis is already helping researchers uncover suspicious firmware paths quickly, making opaque embedded targets more auditable.
- Faster AI-enabled discovery could force long-hidden security bugs into the open and leave infrastructure more resilient after the remediation surge.
Concerns
- Finding a use-after-free is not the same as weaponizing it: the AI struggled to bridge heap manipulation, leaks, mitigation bypasses, and reliable code execution.
- AI may turn vulnerability disclosure into a relentless operational treadmill, exposing defenders to a volume of urgent fixes they cannot realistically absorb.
