Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions

Summary

A Linux kernel TCP race condition, tracked as CVE-2026-98432, affects Ubuntu, RHEL and other distributions. The kernel CVE team rates it 9.8, while Red Hat, Amazon, Oracle and SUSE score it between 5.9 and 8.1. Anthropic said its AI model wrote an exploit that lets an unauthenticated remote attacker run commands as root on servers with a multipath TCP listener.

Mitigation

Debian, Oracle Linux, SUSE and Amazon Linux have shipped fixed kernel packages for at least some kernels, including kernel6.12-6.12.113-138.209.amzn2023 and kernel-default 6.12.0-160000.40.1 or later for SUSE. Ubuntu and RHEL have not released a fixed kernel as of October 29; Red Hat says its fixes are deferred to a future update.

Related items

• InfoBuilding a multiplayer game world with autonomous Fable-class modelsSame vendor · Simon Willison's Weblog
• MediumFake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto MinersSame vendor · The Hacker News
• InfoGoogle Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon ModelSame vendor · SecurityWeek
• Low3 Ways AI Agents Already Operate in Your BrowserSame vendor · BleepingComputer
• InfoAnthropic is asking Wall Street to believe in AGISame vendor · The Verge (AI)