CVE-2026-98432 is a use-after-free in the IPv4 TCP handshake code (tcp_v4_syn_recv_sock() hands the request's IP options to the child socket without copying them, so another CPU answering a retransmitted SYN can read freed memory). It dates back to Linux 4.4. The kernel CVE team scores it 9.8; IPv6 is not affected. Anthropic said on Oct 27 that its model built a root exploit against servers with a multipath TCP listener (covered here Oct 28).

• Ubuntu: priority High; the main linux package is "pending" for 22.04, 24.04, 26.04 and 26.10 and "needed" for 16.04, 18.04 and 20.04. No fixed kernel yet.
• Red Hat: rates it Moderate (CVSS 5.9, availability only) because the race is hard to win; fixes for RHEL 8, 9 and 10 are "deferred to a future update." RHEL 7 is not affected. Red Hat says a remote attacker who can reach an exposed TCP service could trigger it, most likely crashing the kernel.
• Fixed: Debian (trixie DSA-6568-1; bookworm DLA-4841-1 / DLA-4850-1), Oracle Linux UEK, some SUSE releases and some Amazon Linux 2023 kernels, per their trackers as summarized by The Hacker News. Upstream fixes are in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10.

What to do: install the fixed kernel and reboot where your distribution has one. On Ubuntu and RHEL, track the vendor pages and prioritize internet-facing hosts once kernels ship. No vendor lists a mitigation; whether disabling MPTCP helps is not stated by any vendor, so do not rely on it alone.