CVE-2026-98432 is a use-after-free in the Linux kernel’s IPv4 TCP handshake path. The flaw appears when two processors act on related request and child sockets while both can still reference the same IP options object. One path may free that object immediately while another path, protected only as an RCU reader, continues to use it. The result is a stale kernel pointer in code reachable through network traffic.
The concise description sounds like a familiar kernel race, but the public evidence demands careful interpretation. The CVE record carries a CVSS 3.1 score of 9.8, representing a network-reachable, unauthenticated worst case with high confidentiality, integrity, and availability impact. Red Hat’s product analysis assigns a lower 5.9 score because it treats exploitation as a difficult race and assesses the practical consequence in its supported products more conservatively. Separately, Anthropic’s Frontier Red Team reported a working remote root code-execution chain against a Linux server with a Multipath TCP listener in a controlled lab. That result is serious evidence of exploitability under a specific configuration. It is not evidence that every unpatched Linux server, every ordinary TCP listener, or every distribution build can be compromised in the same way.
