A critical vulnerability in the Linux kernel, tracked as CVE-2026-98432, could allow remote attackers to execute arbitrary code with root privileges on vulnerable systems without authentication or user interaction.
Rated CVSS 9.8 (Critical), the flaw is a use-after-free vulnerability in the kernel’s IPv4 TCP networking subsystem. It affects Linux kernels dating back to version 4.4 and can be triggered through specially crafted TCP connection requests containing IPv4 options.
Red Hat has released security updates for RHEL 8, 9, and 10, while fixes for Ubuntu 22.04, 24.04, and 26.04 are currently available in the optional testing repository.
The vulnerability has also attracted attention because Anthropic reported that an internal Claude research model successfully developed a remote root exploit. According to the research, the exploit could obtain kernel-level access without requiring credentials. However, the exploit code has not been publicly released.
Although no confirmed in-the-wild exploitation has been reported, the vulnerability presents a serious risk to internet-facing Linux servers.
Security Recommendation: System administrators should prioritize installing the latest kernel security updates and rebooting affected systems to ensure the patched kernel is running.
Sources: