A serious Linux kernel flaw worth knowing about, especially if you run
Ubuntu or RHEL:

- CVE-2026-98432 is a race condition (use-after-free) in the kernel's
IPv4 TCP connection setup. A remote attacker with no credentials can
trigger it; the kernel's own CVE team rates it 9.8 out of 10.
- Anthropic says its Claude AI model wrote an exploit for it that gets
root on servers with a multipath TCP (MPTCP) listener - about 48
minutes to leak a kernel address, 5 more to root. The exploit code was
not published, and as of Oct 29 there are no reports of attacks in the
wild.
- The bug dates back to Linux 4.4. It was fixed upstream on Oct 5 and
backported to all maintained stable kernels (5.10.272, 5.15.223,
6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3). IPv6 is not
affected.
- Fix status (as of Oct 30): Debian, Oracle Linux, and some SUSE and
Amazon Linux releases have fixed kernels out. Ubuntu (22.04, 24.04,
26.04, 26.10) and RHEL 8/9/10 do NOT yet, with no release date given.
Vendors rate it lower than 9.8 (5.9 to 8.1), disagreeing on how hard
the race is to win.
- What to do: install the fixed kernel where your distro has one.
Ubuntu and RHEL users should watch for the update and apply it
promptly when it lands. Disabling MPTCP (e.g. GODEBUG=multipathtcp=0
for Go programs) is only a fragile partial mitigation - the real fix
is the patched kernel.

Full article: https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

-------------------------------------------------------------------- Cochise Linux Users Group Mailing List - cochiselinux@wxyz For more information: https://cochiselinuxusergroup.org/ Discord: https://discord.gg/ym2hCH5FSk Mailing List Archive: https://www.freelists.org/archive/cochiselinux To unsubscribe: //www.freelists.org/list/cochiselinux