Critical Linux TCP Vulnerability CVE-2026-98432 Demands Urgent Patching

A critical CVSS 9.8 Use-After-Free flaw in the Linux IPv4 TCP handshake allows remote unauthenticated root command execution.

Stable Linux kernels have received patches for CVE-2026-98432, a severe Use-After-Free vulnerability residing in the IPv4 TCP handshake mechanism. Scoring a critical 9.8 CVSS rating and affecting kernels dating back to version 4.4, the bug can be reached by a remote, unauthenticated peer before any application processes the connection.

Security researchers demonstrated that an automated exploit script written by Claude could achieve root execution on vulnerable servers running multipath TCP listeners. With major Linux distributions working through backports, server administrators face an urgent remediation window.