Ubuntu and Red Hat Still Lack a Fix for CVE-2026-98432 Linux Flaw

Where the CVE-2026-98432 Ubuntu patch stands

There is still no CVE-2026-98432 Ubuntu patch, and Red Hat Enterprise Linux has none either. Anthropic says its unreleased Claude model turned this critical Linux kernel TCP flaw into a working root exploit. As of October 29, neither vendor had shipped a fixed kernel, while Debian, Oracle Linux, SUSE and Amazon Linux already had.

Ubuntu's tracker lists work in progress for 22.04, 24.04, 26.04 and 26.10, and marks 16.04, 18.04 and 20.04 as vulnerable, according to Rescana's analysis. Red Hat lists the fix for RHEL 8, 9 and 10 as deferred with no date. Rocky Linux and AlmaLinux rebuild from RHEL source, so they inherit the gap until Red Hat ships. PatchMon's status page makes the same point. RHEL 7 is not affected, according to The Hacker News.

What the TCP use-after-free does

The bug is a use-after-free in the IPv4 TCP handshake code of the Linux kernel. The kernel CVE team published the record on October 15, 2026, and scored it CVSS 3.1 9.8 (Critical) on October 24. That score means a remote attacker needs no credentials and no user interaction. The flaw has existed since Linux 4.4, so it reaches most maintained distribution kernels.

Anthropic said on October 27 that its unreleased model wrote an exploit using the flaw. According to The Hacker News, the exploit lets a remote attacker with no credentials run commands as root on Linux servers with a multipath TCP listener. Anthropic's post says the bug "was patched upstream and backported to all maintained stable kernel branches." USA 24 first reported the exploit claim in our earlier story on Anthropic's Linux kernel exploit, so this piece focuses on the patch gap.

That gap is the real problem. Stable kernel fixes shipped October 15 in Linux 6.12.113, 6.6.159, 6.1.190, 5.15.223 and 5.10.272, according to Atlas. Anyone can read the public advisory and see which distributions have fixed kernels. GitHub repositories that reference the CVE have appeared, and some researchers say a working exploit now exists. The sources reviewed for this story do not confirm active exploitation in the wild.

Two details remain unsettled. Ubuntu rates the flaw 9.8 with High priority. Red Hat's CVE page scores it 5.9 Moderate, while its advisory says 8.1 Important. The fix date is also disputed: one source says the upstream fix landed October 5, while another says stable kernels shipped it October 11 and 15.

Which distributions have fixes and which do not

Debian moved fastest, shipping its Debian 13 package one day after the stable kernel releases. Amazon Linux 2023 shipped in two stages, which suggests it is patching each kernel branch as it goes. Ubuntu and RHEL matter most for many production fleets, so their silence is the part that will draw the most attention. Operators on the fixed distributions should confirm they have installed the new kernel and rebooted, not just that an update exists.

What the KEV listing means for federal agencies

Under BOD 26-04, federal civilian agencies must prioritize fast remediation of Known Exploited Vulnerabilities on publicly exposed assets that grant total control after exploitation. CISA's October 28 update added two entries: CVE-2026-46300, a different Linux kernel flaw involving missing variable initialization, and a VMware ESX logging flaw. USA 24 covered the Linux entry in our report on the Fragnesia flaw. None of the sources reviewed for this story confirms that CVE-2026-98432 appears in the catalog.

If CISA adds CVE-2026-98432, agencies running unpatched Ubuntu or RHEL hosts would face a remediation deadline without a vendor kernel to install. They would have to rely on mitigations until a fixed kernel ships. That situation tests how well agencies track their Linux inventory, because the directive focuses on exposed systems, not on the number of hosts that could theoretically be affected.

Steps to take while Ubuntu and Red Hat work on fixes

The following steps draw on vendor guidance and the research cited in this story.

• Inventory every host running an Ubuntu or RHEL kernel, including Rocky Linux and AlmaLinux. Note which ones accept IPv4 TCP connections from the internet.
• Watch Ubuntu's and Red Hat's CVE pages. When a fixed kernel appears, install it and reboot, because a kernel update takes effect only after restart unless a live patch is offered.
• Check whether multipath TCP listeners are enabled on your servers. Review the net.ipv4.tcp_migrate_req setting and any BPF reuseport use, which the fix also covers.
• Install kernel packages only from vendor-approved channels. Avoid unofficial builds and packages from unknown repositories.
• Ostorlab's writeup mentions a stopgap measure. USA 24 has not verified it, so do not apply it without testing and vendor confirmation.

Open questions and what comes next

Neither Ubuntu nor Red Hat has published a date for a fix, and the sources offer no timeline. Anthropic's exploit reportedly needs a multipath TCP listener. The CVE text, however, names the plain IPv4 TCP functions, and Anthropic has not said whether plain TCP is exploitable. Administrators should assume plain TCP may be affected until vendors or researchers settle the question.

Three developments would change the risk picture: Ubuntu or Red Hat shipping a kernel, CISA adding the CVE to its catalog, and an independent team verifying a public exploit. For now, the work is the same regardless of how those play out. Know which hosts run the affected kernels, reduce their exposure, and be ready to reboot the day a vendor fix lands.