Threat reportVulnerabilityTL-2026-4751
CVE-2026-98432 - Linux Kernel IPv4 TCP SYN Race Condition / Use-After-Free (inet_opt / ireq_opt) Enabling Remote Kernel Memory Corruption and Reported Root Command Execution
CVE-2026-98432 (TL-2026-4751) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-29. It has no confirmed attribution, affects Linux Linux kernel (net/ipv4 TCP), references 1 CVE (CVE-2026-98432), maps to 6 MITRE ATT&CK techniques (T1059, T1059.004, T1068), and is covered by 9 detection rules and 19 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 19Indicators of compromise
Key facts for TL-2026-4751
- Threat ID
- TL-2026-4751
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud, telecoms, finance, government administration, critical infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
- Updates
- 2026-10-29 · revalidated 1× · latest source
Malware and tooling in CVE-2026-98432
Malware and tooling: SynAck, root, Unreleased Claude model (Anthropic Frontier Red Team)
How CVE-2026-98432 works
A race-condition use-after-free in the Linux kernel IPv4 TCP stack (tcp_v4_syn_recv_sock() / ip_options_build()) can be triggered by an unauthenticated remote attacker sending retransmitted SYN packets, causing kernel memory corruption. A secondary news report says Anthropic's Frontier Red Team built a lab exploit achieving root command execution; no public PoC or in-the-wild exploitation is documented by primary trackers.
CVE-2026-98432 (published 2026-10-15) affects the IPv4 TCP handling in the Linux kernel. tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Readers such as tcp_v4_send_synack() and inet_csk_route_req() access the options under rcu_read_lock() only, while inet_sock_destruct() and tcp_v4_reqsk_destructor() free them with a plain kfree() without an RCU grace period. A second CPU processing a retransmitted SYN can therefore build a SYN-ACK from freed memory, producing a use-after-free in ip_options_build(). A similar issue exists in request-socket migration scenarios. IPv6 is not affected by the primary issue because tcp_v6_syn_recv_sock() duplicates options, although a related IPv6 migration issue (ipv6_opt) and a CALIPSO migration issue need separate fixes.
The upstream fix switches the destructors to kfree_rcu() so that inet_opt and ireq_opt are freed only after an RCU grace period. Affected versions run from Linux 4.4 (bug introduced by commit 079096f103fa 'tcp/dccp: install syn_recv requests into ehash table') up to the fixed stable releases 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7. Wiz lists upstream fix commit e3f33b0a1d89d738e2b913dab519226eaf76e15b. Ubuntu 26.04, 24.04 and 22.04 were still work-in-progress and 20.04 and 18.04 vulnerable at time of review (including AWS, Azure, GCP and Oracle kernel flavors); SUSE shipped fixes for SLES 16.0 / Micro 6.2 while older LTSS products were pending.
According to Cyber Security News (2026-10-29), which cites an Anthropic Frontier Red Team disclosure dated 2026-10-27, an unreleased Claude model produced a working lab exploit in two phases: a race that leaks kernel pointers to defeat KASLR (about 48 minutes in lab testing), then a callback-pointer overwrite that runs an attacker payload as root (about 5 minutes). The report frames this as controlled lab research, not an in-the-wild incident. This claim is not corroborated by a primary source reviewed here: Anthropic's Frontier Red Team page lists a 2026-10-27 post titled 'Discovering and exploiting vulnerabilities in critical, real-world software with Claude' but no CVE-specific entry, and NVD, Wiz and other trackers state that no public PoC or exploitation was reported as of 2026-10-15.
Severity is inconsistent across sources. NVD / Linux CNA and Ubuntu rate it CVSS 3.1 9.8 (AV:N/AC:L/PR:N), while SUSE and Wiz rate it 8.1 (SUSE vector AV:N/AC:H, reflecting the race) and one aggregator reported 5.9 with a crash-only impact. Red Hat rates it High. The 9.8 value is used here with that caveat. The NVD record status was 'Received' (not yet analyzed). Not listed in CISA KEV per Wiz. Practical impact is at minimum remote kernel crash (DoS) for any host with an internet-reachable IPv4 TCP listener; reliable code execution depends on winning a race and is unconfirmed by primary sources.
MITRE ATT&CK techniques used in TL-2026-4751
Execution
T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Discovery
T1082 System Information Discovery
Initial Access
T1190 Exploit Public-Facing Application
Impact
Affected products and versions in CVE-2026-98432
- Linux — Linux kernel (net/ipv4 TCP)
Vulnerable versions: 4.4 through 7.2.x prior to fixed releases
Fixed in: 5.10.272; 5.15.223; 6.1.190; 6.6.159; 6.12.113; 6.18.56; 7.2.10; 7.3-rc7 - Canonical — Ubuntu kernel (incl. AWS, Azure, GCP, Oracle flavors)
Vulnerable versions: 18.04 LTS; 20.04 LTS; 22.04 LTS (fix in progress); 24.04 LTS (fix in progress); 26.04 LTS (fix in progress) - SUSE — SLES 16.0, SLE Micro 6.2, openSUSE Leap 16.0, SLES 15 SP4-SP6 LTSS, SLE Micro 5.3-5.5
Vulnerable versions: SLES 15 SP4-SP6 LTSS and SLE Micro 5.3-5.5 pending at time of review
Fixed in: SLES 16.0 / Micro 6.2 kernel >= 6.12.0-160000.40.1
Remediation for CVE-2026-98432
Patches
- Upstream stable: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3-rc7
- SUSE: kernel >= 6.12.0-160000.40.1 (SLES 16.0 / Micro 6.2) or >= 5.14.21-150500.55.195.1; advisories SUSE-SU-2026:24386-1 and SUSE-SU-2026:24422-1
- Oracle Linux: fixed packages shipped per Cyber Security News
Immediate actions
- Install the vendor kernel update containing the upstream kfree_rcu() fix and reboot to activate it
- Restrict exposure of IPv4 TCP listeners to the internet with firewall rules; expose only required services
- Monitor for unusual TCP resets, repeated/retransmitted SYN bursts and failed handshakes against listening services
- Alert on unexpected kernel oops/panic and KASAN/slab use-after-free messages in dmesg and journald
Workarounds
- Disable multipath TCP listeners if not needed (per Cyber Security News)
- Place affected hosts behind a firewall or load balancer that terminates TCP so that attacker SYNs do not reach the host kernel
Longer-term hardening
- Track distribution advisories for Ubuntu 18.04-26.04, cloud-provider kernels (AWS, Azure, GCP, Oracle) and SUSE LTSS products still pending fixes
- Enable kernel hardening (KASLR, SLAB freelist hardening, init_on_free) and keep an inventory of kernel versions per host
- Use live-patching where the vendor supports it to shorten the exposure window
CVEs associated with CVE-2026-98432
Weaknesses (CWE) in CVE-2026-98432
Timeline of CVE-2026-98432
- Linux kernel fix committed upstream (e3f33b0a1d89d738e2b913dab519226eaf76e15b, 7.3-rc7), freeing inet_opt and ireq_opt after an RCU grace period.
- At disclosure, trackers (Wiz, stack.watch) report no public PoC and no in-the-wild exploitation; not in CISA KEV
- CVE-2026-98432 published (Linux kernel CNA); Red Hat opens tracking bug 2553390 rated High; upstream fix switches inet_sock_destruct() and tcp_v4_reqsk_destructor() to kfree_rcu()
- Debian (trixie linux 6.12.113-1) and Oracle Linux (ELSA-2026-500397/398/399) ship fixed kernels.
- Amazon Linux 2023 begins releasing fixed kernel6.18/kernel6.12 packages (completed by 2026-10-29).
- NVD record last modified (status 'Received'), listing eight stable-branch fix commits
- Anthropic Frontier Red Team publishes research on discovering and exploiting vulnerabilities with Claude; Cyber Security News attributes a lab exploit for this CVE to an unreleased Claude model
- Ubuntu tracker updated: 20.04 and 18.04 vulnerable; 22.04, 24.04, 26.04 fixes in progress
- Cyber Security News reports the lab exploit (about 48 minutes for KASLR-defeating pointer leaks, about 5 minutes for root command execution); SUSE record updated with fixed SLES 16.0 / Micro 6.2 kernels and advisories SUSE-SU-2026:24386-1 and SUSE-SU-2026:24422-1
Update history for TL-2026-4751
- 2026-10-29 — Linux Kernel IPv4 TCP Race Condition Use-After-Free (CVE-2026-98432) Affects Ubuntu, Red Hat and Other Distributions: What changed No field escalation. Exploitability stays THEORETICAL, status stays MONITORING and severity stays CRITICAL. The newer report says the Anthropic PoC exists, but also says public PoC release is unverified and no in-the-wild explo
Sources cited for CVE-2026-98432
- Claude AI Exploits Linux Kernel Flaw to Execute Root Commands Without User Interaction
- NVD - CVE-2026-98432
- Red Hat Bugzilla 2553390 - CVE-2026-98432 kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period
- SUSE CVE-2026-98432
- Ubuntu Security - CVE-2026-98432
- Wiz Vulnerability Database - CVE-2026-98432
- stack.watch - Linux kernel TCP UAF in inet_opt handling (CVE-2026-98432)
- OSV AZL-108246 (Azure Linux)
- Anthropic Frontier Red Team research index (2026-10-27: Discovering and exploiting vulnerabilities in critical, real-world software with Claude)
Detection coverage for TL-2026-4751
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4751 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.