The facts

  1. The Linux CVE authority published the record on 15 October. It describes an IPv4 TCP use-after-free race and assigns CVSS 9.8. Anthropic says its demonstrated attack required no credentials or user interaction on the tested configuration. [1][2]

  2. The CVE record lists fixed upstream branches starting at 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10, as well as 7.3. Distribution packages can carry backported fixes under different version numbers. [2][3]

  3. Ubuntu’s checked advisory marked the generic kernels for 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS vulnerable, with fixes in progress. Versions labelled work in progress are not released security updates. [3]

  4. Red Hat’s checked assessment gives CVSS 8.1 with high attack complexity, differing from the Linux authority’s 9.8. Its advisory describes possible denial of service or memory corruption; the vendor assessments should not be treated as identical. [2][4]

Still unconfirmed

  • The checked sources do not establish exploitation in real attacks or a victim count. The researcher’s demonstration is not evidence of an active campaign.
  • Affected users need the current advisory for their exact distribution and kernel package; the upstream version list is not a universal package-installation instruction.

Sources

References support the numbered facts above. Source checks: 29 Oct 2026, 22:07 UTC.

  1. Discovering vulnerabilities with Claude

    Anthropic · Primary source · 27 Oct 2026

    Actual Linux section read. Remote-root demonstration is attributed to the researcher and limited to its stated multipath TCP configuration.

  2. CVE-2026-98432 official record

    Linux CVE Numbering Authority · Primary source · 15 Oct 2026

    Actual structured CNA record read, including publication date, score and fixed upstream versions; record updated 24 October.

  3. CVE-2026-98432 package status

    Canonical / Ubuntu · Primary source · 15 Oct 2026

    Actual generic-kernel status read. Work-in-progress entries are not described as available patches. Advisory marked updated 28 October.

  4. CVE-2026-98432 assessment

    Red Hat · Primary source

    Current rendered description and 8.1 score checked. An older lower score quoted elsewhere is not substituted for the current assessment.

  5. Linux kernel TCP flaw and distribution fixes

    The Hacker News · Reporting · 29 Oct 2026

    Independent security-news reporting opened; technical claims above checked against original researcher, CNA and vendors. No claim that all distributions remain unpatched.

Report a factual error