GoKawiilCritical Linux TCP Flaw CVE-2026-98432 Gets Root Exploit PoC via Claude AI
A use-after-free bug in Linux's IPv4 TCP handshake, present since kernel 4.4, has been patched upstream with fixed releases spanning 5.10 through 7.3, but Ubuntu and RHEL have not yet shipped fixes as of October 31. Anthropic says its Claude model produced a working proof-of-concept that gains root access with no credentials on servers running multipath TCP listeners, and Go's security team notes Go programs enable such listeners by default.
GoKawiil's interpretation of the reporting above, not reported fact.
The vulnerability triggers before any application logic runs, meaning patch delays at the distribution level leave widely deployed servers exposed regardless of what software they host. The AI-generated exploit suggests that automated tools can now turn a terse kernel advisory into a working attack faster than some vendors can ship fixes, which could pressure distributions like Ubuntu and Red Hat to accelerate their patch timelines.
- CVE-2026-98432 is a CVSS 9.8 use-after-free in Linux's TCP handshake, fixed upstream but not yet in Ubuntu or RHEL kernels.
- Anthropic reports its Claude AI model created a working root-level exploit requiring no credentials against multipath TCP listeners.
- Go programs open multipath TCP listeners by default, widening the pool of vulnerable servers beyond initial assumptions.
Source: atlasum.net — Atlas Security, 2026-10-31
Published there as: “TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.