A use-after-free race in the Linux kernel's IPv4 TCP connection-setup code, tracked as CVE-2026-98432, is rated 9.8 by the kernel's own CVE team and lets a remote, unauthenticated attacker execute code as root on servers with a multipath TCP (MPTCP) listener. Anthropic said on 27 October that an AI model it developed wrote an exploit for the flaw — the latest in a run of model-produced working exploits — and an Anthropic researcher, Xinyang Ge, is credited with reporting the bug. As of 29 October, Ubuntu and Red Hat Enterprise Linux had not released fixed kernels, leaving mainstream server distributions exposed; Red Hat, Amazon, Oracle and SUSE score the flaw lower (5.9–8.1), and the fix does not mention MPTCP, so operators should treat the vendor score disagreement as uncertainty, not clearance. Organisations should watch for the kernel updates now in flight and plan same-day patching, especially for internet-facing hosts.

• Source article