Linux Kernel TCP Flaw CVE-2026-98432 Has No Ubuntu Fix Yet; Go Cites Exploit

On 29 October 2026, a notice from the Go Security Team said an exploit described by Anthropic showed remote code execution on servers with Multipath TCP listeners. The notice was posted to the golang-announce list and forwarded to the oss-security mailing list by Alan Coopersmith. The flaw is CVE-2026-98432, a use-after-free bug in the Linux kernel’s IPv4 TCP code.

The notice said the bug is not specific to Multipath TCP, and that systems with no MPTCP listeners may be vulnerable to similar attacks. The kernel’s CVE record was first published on 15 October and last updated on 30 October. Ubuntu’s tracker, last updated on 30 October, listed its supported releases as vulnerable, with work in progress.

What the Kernel Record Says About the Flaw

The Linux kernel CNA record describes a race in the IPv4 handshake path. When a connection request becomes a full socket, its IP options pass to the child socket. A retransmitted SYN arriving on another CPU at that moment can still read those options while building a SYN-ACK, after they have been freed.

The record says the flaw has existed since commit 079096f103fa. Ubuntu’s summary says that since that commit, request sockets have been processed without the listener lock, and inet_sock_destruct() frees the IP options with a plain kfree() call. The fix uses kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor().

The record scores the flaw 9.8, Critical, under CVSS 3.1. The vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, describes a network attack with low complexity and no required privileges or user interaction. The record also covers a similar issue with request socket migration, which the record says arises with the net.ipv4.tcp_migrate_req sysctl or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program.

The affected range starts at kernel 4.4 and runs until fixed releases in the stable branches, including 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10. Version 7.3 is listed as the original fixing commit. The record says IPv6 is not affected by the first issue. The record adds that the IPv6 migration issue involves an option set only by CALIPSO, and that it will be addressed in a separate patch.

Kernel CNA Score
The Linux kernel CNA scores CVE-2026-98432 at 9.8, Critical, under CVSS 3.1. The CVE record was first published on 15 October 2026 and last updated on 30 October 2026.

What Anthropic’s Research Post Describes

Anthropic’s Frontier Red Team post, dated 27 October, describes five attack chains that an unreleased, internal research model helped find and exploit in widely used software. The post says Claude wrote the exploits after initial prompting. The Linux case is one of the five, alongside cases in Chrome, Safari, Android and Windows.

According to the post, a remote attacker could send packets to Linux servers with a multipath TCP listener and run arbitrary commands with root privileges, without credentials or user interaction. The attack first defeats kernel address randomization, known as KASLR, by leaking a kernel pointer. It then overwrites a callback pointer to hijack control flow.

The proof of concept took 48 minutes to leak the pointer and five more minutes to reach shell execution.

The post says the bug was patched upstream and backported to all maintained stable kernel branches. Ubuntu’s tracker still lists its supported releases as vulnerable, with work in progress.

Anthropic says it reported each bug under its coordinated vulnerability disclosure policy. That policy allows vendors 90 days to patch, followed by 45 more days before details beyond the public advisory are discussed.

Ubuntu Pending, Red Hat Status Unclear

Ubuntu rates the flaw High priority, with a CVSS 3 score of 9.8. Its tracker lists the linux package as vulnerable, with work in progress, for Ubuntu 26.10 (7.3.0-10.10), 26.04 LTS (7.0.0-43.43), 24.04 LTS (6.8.0-149.149) and 22.04 LTS (5.15.0-203.213). Ubuntu 20.04, 18.04 and 16.04 are listed as vulnerable, and 14.04 as not affected.

The linux-aws, linux-azure, linux-gcp and linux-oracle packages carry the same work-in-progress status on those four supported releases. The linux-fips package is listed as work in progress on 24.04 and 22.04, and linux-hwe-6.8 on 22.04 is also listed as work in progress.

Red Hat rates the flaw Critical, with the same 9.8 score and vector. Its description of the main result differs from the Go notice. Red Hat describes a race in IPv4 networking that mainly causes a crash or denial of service, and possibly memory corruption, and says reliable code execution would require precise heap control. The Go notice describes remote code execution.

Red Hat links advisory RHSB-2026-016 and Bugzilla entry 2553390, and says its scores are preliminary and subject to review. This article does not state a fix status for specific RHEL releases, so readers on RHEL should check the linked advisory and bug entry.

Ubuntu’s tracker still lists its supported releases as vulnerable, with work in progress.

Multipath TCP and Go’s Default Setting

Multipath TCP lets a single TCP connection use several network paths at once, which can increase throughput and add redundancy. It was first published as an experimental standard in RFC 6824 in January 2013, and RFC 8684 replaced it in March 2020. It is backward compatible with TCP. Apple shipped it in iOS 7 on 18 September 2013, and the Linux reference implementation was mainlined in version 5.6.

Since Go 1.24, Go programs enable Multipath TCP by default for listening sockets on Linux. The multipathtcp GODEBUG setting has four values. The default, 2, enables it on listeners only. The value 0 disables it on dialers and listeners and reverts to the pre-Go 1.24 behavior. The value 1 enables it on dialers and listeners, and 3 enables it on dialers only. Go 1.21 added support but used it only when an application explicitly asked for it.

The notice says GODEBUG=multipathtcp=0 can be set in a program’s environment at runtime, or add a godebug line with multipathtcp=0 to the main module’s go.mod file at build time. Per-socket settings through net. Dialer.SetMultipathTCP and net. ListenConfig.SetMultipathTCP override those defaults.

The Go team calls per-program disabling a fragile mitigation. One leftover Multipath TCP listener would still leave a system exposed, and the approach assumes all viable exploits depend on Multipath TCP. The team considers changing Go’s defaults premature and points to Go issue 82717 for discussion.

What Remains Open as of 30 October

For Linux servers in general, the notice’s stated remedy is to upgrade to a patched kernel version. The kernel record’s list of fixed stable releases shows which branches carry the fix.

As of 30 October, the sources do not give Ubuntu a fix date. The notice names no patch schedule for distributions, and the Go team says it is premature to change its defaults.

The sources differ on two points. The Go notice describes remote code execution, while Red Hat describes mainly a crash or denial of service. Anthropic’s post says the bug was patched upstream and backported to all maintained stable branches, while Ubuntu lists its supported releases as work in progress. Anthropic’s post also describes commands run with root privileges.