CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Red Hat Enterprise Linux

product · product:red-hat-enterprise-linux

Coverage
1
first 2026-10-31 → last 2026-10-31
Latest activity
2026-10-31
Linux TCP use-after-free: Anthropic built a remote root exploit; Ubuntu and RHEL kernels still unfixed
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
9
9 hosts

Action items (1)

Do-now tasks recorded on the entries about Red Hat Enterprise Linux, newest first. Check the date before acting on an older one.

  • On every internet-facing Linux server, install the distribution kernel that fixes CVE-2026-98432 and reboot as soon as it ships (Debian bookworm 6.1.190-1 and trixie 6.12.113-1 are out; Ubuntu and RHEL kernels were not as of 2026-10-30), and until then drop IPv4 TCP packets that carry IP options ahead of the TCP stack as CIQ describes, after testing on one non-production host because it also drops legitimate option-bearing traffic; disabling MPTCP alone does not close the path.
    2026-10-31CVE-2026-98432

Defender insights

What each entry about Red Hat Enterprise Linux tells a defender to do, newest first.

2026-10-31NOTABLELinux TCP use-after-free: Anthropic built a remote root exploit; Ubuntu and RHEL kernels still unfixed

Exposure · detection

Story timeline

  1. 2026-10-31CVE-2026-98432, Linux kernel IPv4 TCP: a use-after-free in connection setup, present since 4.4, has an Anthropic-built remote root exploit against MPTCP listeners; Debian is fixed, Ubuntu and Red Hat kernels are not yet (CVSS 9.8)
    trending-vulnerabilitiesLinux TCP use-after-free: Anthropic built a remote root exploit; Ubuntu and RHEL kernels still unfixed

Hunting pivots

CVEs
CVE-2026-98432
Releases covered
Red Hat Enterprise Linux
Tags
dospatch-availablepre-authrcevulnerabilitieszero-click
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ImpactEndpoint Denial of Service: Application or System Exploitation

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-31/cve-2026-98432-linux-kernel-tcp-uaf-mptcp-remote-root · ATT&CK page ↗

Impact TA0040

T1499.004Endpoint Denial of Service: Application or System Exploitation×1

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users. Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.

Evidence: 2026-10-31/cve-2026-98432-linux-kernel-tcp-uaf-mptcp-remote-root · ATT&CK page ↗

Entries about Red Hat Enterprise Linux (1)

2026-10-31 · view entry permalink →

NOTABLECVE-2026-98432NATOB2

CVE-2026-98432, Linux kernel IPv4 TCP: a use-after-free in connection setup, present since 4.4, has an Anthropic-built remote root exploit against MPTCP listeners; Debian is fixed, Ubuntu and Red Hat kernels are not yet (CVSS 9.8)

The Linux kernel CVE team published CVE-2026-98432 on 2026-10-15: a use-after-free in the IPv4 TCP connection setup path, introduced in Linux 4.4 and fixed upstream in 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7 (Linux kernel CVE team, 2026-10-15). An unauthenticated peer starts it by sending TCP SYN packets that carry IPv4 options, and a retransmitted SYN or the ACK of the syncookie path can then touch the freed option memory (CIQ, 2026-10-30). Anthropic wrote on 2026-10-27 that Claude produced an exploit that lets a remote attacker send packets to a Linux server with a multipath TCP (MPTCP) listener and run arbitrary commands as root without credentials (Anthropic, 2026-10-27). The Go team says the bug is not specific to MPTCP, that systems with no MPTCP listener may be open to similar attacks, and that since Go 1.24 Go programs enable MPTCP on Linux listen sockets by default (Go team, 2026-10-29). NCSC-NL judges large-scale abuse unlikely given the exploit's complexity and the mitigations distributions carry (translated from Dutch) (NCSC-NL, 2026-10-30), and BleepingComputer found no confirmed report of exploitation in the wild (BleepingComputer, 2026-10-30).

Severity is disputed: the CNA scores it 9.8, upstream 8.1 with high attack complexity (CIQ, 2026-10-30), and Red Hat rates it Critical for RHEL because it lets an unauthenticated remote attacker cause kernel memory corruption or an immediate crash over ordinary IPv4 TCP traffic, while saying reliable code execution needs precise heap control (Red Hat, 2026-10-31). Patch state as read on 2026-10-30 and 2026-10-31: Debian's security kernels 6.1.190-1 (bookworm) and 6.12.113-1 (trixie) are fixed (Debian Security Tracker, 2026-10-31); Ubuntu 22.04, 24.04, 26.04 and 26.10 are marked vulnerable with work in progress and 20.04, 18.04 and 16.04 vulnerable (Canonical, 2026-10-30); Red Hat lists RHEL 8, 9 and 10 as affected and RHEL 7 as not affected (BleepingComputer, 2026-10-30); BleepingComputer reports fixes for some kernel versions from Oracle Linux, Amazon Linux and SUSE (BleepingComputer, 2026-10-30); and CIQ had published no patched kernel for its RLC Pro LTS 9.6, RLC Pro LTS 8.10 or RLC Pro 10 variants and refers Rocky Linux community releases to Rocky errata (CIQ, 2026-10-30).

Issue introduced in 4.4

Linux kernel CVE team (linux-cve-announce) 2026-10-15

allows a remote attacker to send packets to Linux servers with a multipath TCP listener to run arbitrary commands as root, without any credentials or user interaction

Anthropic Frontier Red Team 2026-10-27

While the demonstrated exploit requires the target system to expose an MPTCP listener, the underlying bug is not specific to MPTCP.

Go team (golang-announce) 2026-10-29

An unauthenticated network peer can start the flaw by sending TCP SYN packets that carry IPv4 options.

CIQ (Rocky Linux mitigation article) 2026-10-30

There are currently no confirmed reports of CVE-2026-98432 being exploited in the wild.

BleepingComputer 2026-10-30

Builds on: Public root exploit for a Linux page-cache write past the Dirty Frag fix; AlmaLinux kernels…

vulnerability31 Oct 03:48Zmulti-sourceOpen finding →
Sources: Linux kernel CVE team (linux-cve-announce) · Anthropic Frontier Red Team · Go team (golang-announce) · CIQ (Rocky Linux mitigation article) · Canonical (Ubuntu security tracker) · Debian Security Tracker · Red Hat (CVE page) · NCSC-NL (NCSC-2026-0461) · BleepingComputer

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • access.redhat.com1 (11%)
  • advisories.ncsc.nl1 (11%)
  • anthropic.com1 (11%)
  • bleepingcomputer.com1 (11%)
  • groups.google.com1 (11%)
  • kb.ciq.com1 (11%)
  • lists.openwall.net1 (11%)
  • security-tracker.debian.org1 (11%)
  • other1 (11%)
All cited sources (9)