TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
CVE-2026-98432 is a use-after-free in the Linux IPv4 TCP handshake, reachable by an unauthenticated remote peer and present since kernel 4.4. Upstream fixes shipped October 11 to 18. Atlas reports that Ubuntu and RHEL 8 to 10 remained unfixed on October 31, while Debian, SUSE and Oracle have fixes. Anthropic says Claude built an unpublished root exploit for hosts with a multipath TCP listener. Severity scores and the Go default could not be verified.