GoKawiilLinux kernel TCP use-after-free flaw CVE-2026-98432 draws divergent severity scores
A use-after-free bug has been identified in the Linux kernel's IPv4 TCP handshake code, where a race condition between processors can leave a stale pointer to a freed IP options object. The CVE record rates it 9.8 on CVSS 3.1 as a worst-case network-reachable flaw, while Red Hat scores it 5.9 for its supported products, and Anthropic's Frontier Red Team separately demonstrated a working remote root exploit in a lab setup using a Multipath TCP listener.