Ubuntu announced on November 2, 2026, that fixes for CVE-2026-98432 were available in its -proposed pocket. The announcement places the fixes in that pocket for a Linux kernel vulnerability affecting IPv4 TCP networking. Ubuntu’s announcement
What Anthropic’s proof of concept did
Anthropic said its unreleased internal research model produced a proof of concept that ran commands as root on a Linux server with a Multipath TCP (MPTCP) listener. The demonstrated attack required no credentials or user interaction, according to Anthropic’s October 27 account.
Anthropic reported that its proof of concept took 48 minutes to leak a kernel pointer, then another five minutes to reach shell command execution. Those timings describe that demonstration.
The demonstrated MPTCP path and the IPv4 TCP flaw
CVE-2026-98432 is a use-after-free in the Linux kernel’s IPv4 TCP networking code, according to Red Hat’s security bulletin. A use-after-free occurs when software accesses memory after it has been released.
Anthropic’s proof of concept used an MPTCP listener. Red Hat describes the underlying issue as an IPv4 TCP kernel vulnerability and says systems that accept inbound TCP connections are most directly exposed. The listener condition belongs to Anthropic’s demonstrated path; the advisory’s exposure guidance concerns inbound TCP services.
What Red Hat’s packet filter can do
Red Hat’s October 30 bulletin describes an nftables filter for incoming IPv4 TCP packets with IP options, matching packets where ip hdrlength > 5. Red Hat says the filter can reduce exposure, but cannot fully prevent the vulnerability and may disrupt workloads that need the affected traffic pattern. Red Hat’s advisory identifies a kernel security update as the only complete solution.
