TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
Comments on “TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
CVE-2026-98432 is a use-after-free in the Linux IPv4 TCP handshake, reachable by an unauthenticated remote peer and present since kernel 4.4. Upstream fixes shipped October 11 to 18. Atlas reports that Ubuntu and RHEL 8 to 10 remained unfixed on October 31, while Debian, SUSE and Oracle have fixes. Anthropic says Claude built an unpublished root exploit for hosts with a multipath TCP listener. Severity scores and the Go default could not be verified.
Why it ranked
No. 2 of 59 with a score of 0.76. The panel rated it highest on practical relevance (0.94) and technical depth (0.90), lowest on new information (0.47). The judges disagreed most on new information (spread 0.73), so the story is marked contested. Placed No. 2, No. 3 by score alone: the placement terms moved other stories past it.
- AI judgeJudge 2claude-haiku-5-5
- Critical Linux kernel TCP use-after-free with detailed fix, distro status, and mitigations; highly actionable security news, with a promotional consulting footer and a few sensational framing points.
- AI judgeJudge 3gpt-5.6-luna
- A highly actionable, technically detailed Linux kernel vulnerability advisory with distribution status, mitigations, and verification steps. It substantially overlaps recent coverage of the same CVE and includes a noticeable consulting/audit promotion.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.76total under rubric v2.3Contestedjudges differ by 0.73 on new information
- Significance0.80
- Reader interest0.88
- Audience breadth0.81
- Practical relevance0.94
- Substantiated0.73
- Technical depth0.90
- New information0.47
- Counts against: Promotional0.20
- Counts against: Overclaim0.34
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.78 | 0.80 | 0.82 | 0.80 | 0.04 | +0.24 | +0.192 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.85 | 0.90 | 0.90 | 0.88 | 0.05 | +0.26 | +0.230 |
| Audience breadthHow many people who build technology does it concern? | 0.85 | 0.85 | 0.72 | 0.81 | 0.13 | +0.13 | +0.105 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.94 | 0.95 | 0.91 | 0.94 | 0.04 | +0.22 | +0.206 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.68 | 0.70 | 0.80 | 0.73 | 0.12 | +0.05 | +0.036 |
| Technical depthHow technically substantive is it? | 0.99 | 0.85 | 0.87 | 0.90 | 0.14 | +0.05 | +0.045 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.77 | 0.60 | 0.04 | 0.47 | 0.73 , above the contested threshold | +0.05 | +0.024 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.11 | 0.20 | 0.30 | 0.20 | 0.19 | −0.19 | −0.039 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.47 | 0.30 | 0.24 | 0.34 | 0.23 | −0.11 | −0.037 |
| Sum of contributions | +0.762 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.762 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-01/2/"><img src="https://rubric.hrih.si/badge/2026-11-01/2.svg" alt="Ranked #2 on Rubric, 1 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 3 matches source · 1 no source given · 4 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Couldn’t checkNumber
The Linux kernel CNA scores CVE-2026-98432 as CVSS 3.1 9.8, Critical.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The kernel's own CVE Numbering Authority (CNA) scores it CVSS 3.1 9.8, Critical”
The source says No passage could be compared.
Source cited by the article: cve.org/CVERecord
Couldn’t checkVersion
Linux stable kernels shipped fixes on October 11 and 15, 2026, in versions 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3, and the bug dates back to Linux 4.4.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The fixed releases are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3, and the bug goes back to Linux 4.4”
The source says No passage could be compared.
Source cited by the article: cve.org/CVERecord
Couldn’t checkNumber
Red Hat raised its rating for the bug from Important (8.1) to Critical (9.8) on October 30.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “It raised the bug from Important (8.1) to Critical (9.8) on October 30”
The source says No passage could be compared.
Source cited by the article: access.redhat.com/security/vulnerabilities/RHSB-2026-016
Matches sourceQuote
Anthropic says its Claude model wrote a working proof-of-concept exploit that runs commands as root on Linux servers with a multipath TCP listener, with no credentials.
The cited source says the same thing.
The article says “its Claude model wrote a working proof-of-concept exploit that runs commands as root on "Linux servers with a multipath TCP listener," with no credentials”
The source says “Claude wrote an exploit that allows a remote attacker to send packets to Linux servers with a multipath TCP listener to run arbitrary commands as root, without any credentials or…”
Source cited by the article: anthropic.com/research/discovering-vulnerabilities-with-claude
Matches sourceQuote
Anthropic says in its proof of concept it takes 48 minutes to leak a kernel pointer and another five minutes to reach shell command execution.
The cited source says the same thing.
The article says “it takes 48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution”
The source says “In our proof of concept, it takes 48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution”
Source cited by the article: anthropic.com/research/discovering-vulnerabilities-with-claude
No source givenQuote
The Go Security Team says that as of Go 1.24, Go programs enable MPTCP by default for listen sockets on Linux.
The article gives no link or citation for it.
The article says “as of Go 1.24, Go programs enable MPTCP by default for listen sockets on Linux”
The source says No source to compare with.
Couldn’t checkNumber
As of October 31, Ubuntu's tracker lists its linux kernel package as Vulnerable on every release.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “the tracker lists the linux package as "Vulnerable" on every release”
The source says No passage could be compared.
Source cited by the article: ubuntu.com/security/CVE-2026-98432
Matches sourceDate
AlmaLinux has had fixed kernels for AlmaLinux 8, 9 and 10 in its testing repository since October 30, ahead of RHEL.
The cited source says the same thing.
The article says “have been in its testing repository since October 30, ahead of RHEL”
The source says “Patched kernels are available in the testing repository today, and we would like your help verifying them before we release them to production”
Source cited by the article: almalinux.org/blog/2026-10-30-cve-2026-98432
Also covered by
Elsewhere
Elsewhere: HN 435 pts, front page
Recorded for context only, checked 1 Nov 2026, 05:47 UTC. It played no part in the ranking.