Red Hat’s October 30 bulletin named RHEL 8, 9 and 10, along with Red Hat OpenShift Container Platform, as affected by CVE-2026-98432. Red Hat also published an nftables filter to reduce exposure, but says it cannot fully prevent the vulnerability and does not replace installing a fixed kernel. Its current CVE page, observed November 1, rates the flaw Critical with a CVSS 3.1 score of 9.8.

Red Hat’s filter is a stopgap, not a kernel fix

CVE-2026-98432 is a use-after-free in the Linux kernel’s IPv4 TCP handling. A race during concurrent processing of retransmitted TCP connection requests or socket migration can leave the kernel accessing socket options that have been freed. Red Hat says a remote attacker needs no privileges or user interaction, though precise timing is required. The flaw can cause a crash or memory corruption, and Red Hat says remote code execution is also possible. Red Hat’s CVE page

Red Hat’s October 30 bulletin says its nftables rule drops incoming IPv4 TCP packets that carry IP options, meaning packets with an IPv4 header longer than the standard 20-byte header. The filter can reduce exposure, but may disrupt workloads and cannot fully block the vulnerable code path. Red Hat says a fixed kernel is needed for a complete fix. The bulletin names RHEL 8, 9 and 10 and Red Hat OpenShift Container Platform as affected, and says fixes were being expedited.

Amazon lists its affected kernel families as fixed

Amazon’s security tracker, modified October 30, lists the affected package families for Amazon Linux 2 and Amazon Linux 2023 as Fixed. For Amazon Linux 2, those are the core kernel and the 5.4, 5.10 and 5.15 Extras kernels. For Amazon Linux 2023, the listed families are the default kernel, kernel6.12 and kernel6.18. The same tracker rates the issue Important, CVSS 3.1 8.1. Amazon’s CVE tracker

Red Hat’s 9.8 and Amazon Linux’s 8.1 are the ratings shown by each vendor for its own assessment. They do not change the package status listed by Amazon or Red Hat’s affected-product scope.

MPTCP was used in the demonstration, but does not define the flaw

Multipath TCP (MPTCP) lets a connection use multiple network paths. Anthropic’s October 27 account described a proof of concept created with Claude that reached root command execution on a Linux server with an MPTCP listener. Anthropic reported that its test took 48 minutes to leak a kernel pointer, followed by another five minutes to reach shell-command execution. Those timings describe that proof of concept. Anthropic’s account

The Go Security Team said on October 29 that the underlying kernel bug is not specific to MPTCP and that similar attacks may be possible without an MPTCP listener. Go 1.24 enables MPTCP by default for Linux listen sockets. The team calls disabling it program by program a fragile mitigation and recommends a patched kernel. Go Security Team guidance

Anthropic’s report also covered other exploit chains. NeoTeo’s earlier coverage of those five demonstrations provides that broader context.

Sophos and OpenVPN describe different product configurations

Sophos confirmed on October 30 that Sophos Firewall is affected. The company said MPTCP is disabled on the firewall and may reduce risk, while its engineering team evaluated upstream patches for a future SFOS release. Sophos’s support response

OpenVPN says standard Access Server deployments use single-path TCP for the web interface, OpenVPN daemons and SSH, rather than the MPTCP listener used in Anthropic’s demonstration. It describes the impact on those standard deployments as negligible, but says the host kernel may still be vulnerable and recommends installing the distribution’s fixed kernel and rebooting. OpenVPN’s guidance