Mitigations for CVE-2026-98432 [IPv4 TCP handshake use-after-free]
Comments on “Mitigations for CVE-2026-98432 [IPv4 TCP handshake use-after-free]”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
RODMENA Engineering describes CVE-2026-98432, a use-after-free in the IPv4 TCP handshake present in Linux since 4.4, with upstream fixes in stable branches from 5.10. Debian has patched kernels, while Ubuntu's were still pending on 1 November. Until then, the authors drop IPv4 TCP packets carrying IP options with nftables and disable MPTCP. Their tests showed plain connections passing and optioned ones timing out. The filter doesn't cover new network namespaces or containers. The claims come from the post itself, without independent sourcing, and Anthropic's reported exploit is unseen.
Why it ranked
No. 1 of 43 with a score of 0.82. The panel rated it highest on technical depth (0.97) and practical relevance (0.93), lowest on new information (0.68). Placed No. 1, where the score alone would also have put it: close to “TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8”, No. 2 on Sunday 1 November 2026 (−0.050). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Critical remote kernel use-after-free with detailed root-cause analysis, tested nftables mitigation and reproducible commands; strong practical value for Linux operators, though a mitigation-focused write-up of a known CVE.
- AI judgeJudge 3gpt-5.6-luna
- A highly actionable, technically detailed mitigation and verification write-up for a critical Linux kernel vulnerability, with reproducible configuration and testing. It overlaps recent CVE coverage, while adding substantial operational detail; some exploit and severity claims remain unverified or broad.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.82total under rubric v2.3
- Significance0.79
- Reader interest0.89
- Audience breadth0.83
- Practical relevance0.93
- Substantiated0.84
- Technical depth0.97
- New information0.68
- Counts against: Promotional0.03
- Counts against: Overclaim0.25
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.73 | 0.80 | 0.82 | 0.79 | 0.09 | +0.24 | +0.188 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.82 | 0.90 | 0.94 | 0.89 | 0.12 | +0.26 | +0.231 |
| Audience breadthHow many people who build technology does it concern? | 0.81 | 0.85 | 0.84 | 0.83 | 0.04 | +0.13 | +0.108 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.89 | 0.95 | 0.95 | 0.93 | 0.07 | +0.22 | +0.204 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.82 | 0.85 | 0.86 | 0.84 | 0.04 | +0.05 | +0.042 |
| Technical depthHow technically substantive is it? | 1.00 | 0.92 | 0.98 | 0.97 | 0.08 | +0.05 | +0.048 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.76 | 0.60 | 0.68 | 0.68 | 0.16 | +0.05 | +0.034 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.03 | 0.05 | 0.01 | 0.03 | 0.04 | −0.19 | −0.006 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.23 | 0.20 | 0.32 | 0.25 | 0.12 | −0.11 | −0.028 |
| Sum of contributions | +0.823 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.823 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-02/1/"><img src="https://rubric.hrih.si/badge/2026-11-02/1.svg" alt="Ranked #1 on Rubric, 2 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 8 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenDate
The Linux kernel CVE team published CVE-2026-98432, a use-after-free in the code that completes an IPv4 TCP handshake, on 15 October.
The article gives no link or citation for it.
The article says “On 15 October the Linux kernel CVE team published CVE-2026-98432, a use-after-free in the code that completes an IPv4 TCP handshake”
The source says No source to compare with.
No source givenDate
As of 1 November, Debian had fixed kernels for bookworm and trixie in its security archive, while Ubuntu had fixes in progress for 22.04, 24.04, 26.04 and 26.10 and none released.
The article gives no link or citation for it.
The article says “Debian had fixed kernels for bookworm and trixie in its security archive. Ubuntu’s tracker showed fixes in progress for 22.04, 24.04, 26.04 and 26.10, and none released”
The source says No source to compare with.
No source givenNumber
Red Hat rates the bug Critical at 9.8 and points to mitigation bulletin RHSB-2026-016 without listing a fixed kernel.
The article gives no link or citation for it.
The article says “Red Hat rates the bug Critical at 9.8 and points to a mitigation bulletin, RHSB-2026-016, without listing a fixed kernel”
The source says No source to compare with.
No source givenQuote
Anthropic says one of its internal research models found the bug and wrote a working remote root exploit for servers with a Multipath TCP listener.
The article gives no link or citation for it.
The article says “According to Anthropic, one of its internal research models found the bug and wrote a working remote root exploit for servers with a Multipath TCP listener”
The source says No source to compare with.
No source givenCausal conclusion
The bug has been present since Linux 4.4 in January 2016, introduced by commit 079096f103fa that made request processing lockless.
The article gives no link or citation for it.
The article says “Commit 079096f103fa (“tcp/dccp: install syn_recv requests into ehash table”) made request processing lockless to help busy listeners scale”
The source says No source to compare with.
No source givenVersion
The upstream fix e3f33b0a1d89 by Eric Dumazet changes kfree() to kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor().
The article gives no link or citation for it.
The article says “The upstream fix is e3f33b0a1d89 (“ipv4: free inet_opt and ireq_opt after an RCU grace period”) by Eric Dumazet. It changes kfree() to kfree_rcu”
The source says No source to compare with.
No source givenVersion
The fixed upstream versions are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3.
The article gives no link or citation for it.
The article says “The fixed upstream versions are 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3”
The source says No source to compare with.
No source givenNumber
In the authors' test, the nftables drop rule let plain connections succeed while connections with IP options timed out, with the counter showing 4 packets (the SYN and three retransmissions).
The article gives no link or citation for it.
The article says “The plain connection still succeeds. The connection with options times out, and the counter shows 4 packets, the SYN and its three retransmissions”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 3 pts, not on front page
Recorded for context only, checked 2 Nov 2026, 05:46 UTC. It played no part in the ranking.