What happened?
Since kernel version 4.4, there has been a bug in the Linux kernel’s IPv4 TCP stack relating to the establishment of connections. The kernel developers fixed it in early October 2026; the vulnerability is listed as CVE-2026-98432 and has been rated CVSS 9.8 by Ubuntu and the NVD. On 27 October, Anthropic announced that its AI model, Claude, had written a working root exploit for this vulnerability. Since then, distributions have been rolling out updates; several major providers are still working on them.
| Affected product | Linux kernel, IPv4 TCP connection establishment |
| Affected versions | From kernel 4.4 onwards (IPv6 not affected) |
| Severity | CVSS 9.8 (Kernel-CNA, NVD, Ubuntu); Red Hat, SUSE and Oracle rate it as 8.1 |
| Patch versions | 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3 |
| Consequences | Crash, reading of kernel memory, and even code execution with root privileges |
Why the vulnerability is so dangerous
The flaw is a so-called race condition involving a ‘use-after-free’: when a connection is established, a memory block is passed on without being copied. Anyone who times it right can manipulate this memory. Three characteristics make this critical:
- No authentication required: An attacker only needs to be able to send network packets to the server.
- No system crash on failed attempts: Losing the race merely causes the handshake to fail, not the system itself. Attackers can therefore try as many times as they like.
- Root access in under an hour: In the proof-of-concept, it took 48 minutes to leak a kernel address and a further 5 minutes to gain a root shell.
Who is affected?
Virtually every Linux server running IPv4 that does not yet have a patched kernel. This affects web servers, e-commerce platforms such as Shopware, CMS installations, database and mail servers, container hosts and cloud instances. Servers with a Multipath TCP listener are particularly vulnerable: this is precisely the configuration targeted by the KI exploit. Applications written in Go from version 1.24 onwards enable MPTCP by default.
The patch status varies greatly depending on the distribution (as at the end of October 2026):
- Debian: Trixie and Bookworm are patched.
- Oracle Linux 7–10: patched.
- Amazon Linux 2023: Kernels 6.18 and 6.12 have been patched; further packages are to follow.
- SUSE: Leap 16.0 and Linux Micro 6.2 have been patched; some SLES versions are still undergoing testing.
- Ubuntu 22.04 to 26.10: Updates in progress. 16.04 to 20.04 are affected.
- Red Hat Enterprise Linux 8, 9, 10: affected; according to Red Hat, updates are being rolled out at an accelerated pace.
A blessing and a curse: AI finds vulnerabilities faster than ever before
This case highlights a new reality in IT security. The flaw had been present in the code since kernel 4.4 – that is, for around ten years – in one of the most thoroughly tested codebases in the world. It has now been discovered and turned into a viable attack using AI.
The blessing: more vulnerabilities are being found and patched
We are pleased that AI is helping to uncover such flaws. According to Anthropic, its model has found critical vulnerabilities in widely used software – 62 CVEs in Chrome alone. All were responsibly reported to the manufacturers and patched before details became public. Every vulnerability found is one less that criminals can exploit in secret.
The curse: The window of opportunity between disclosure and attack is shrinking
The same technology is increasingly available to attackers as well. Anthropic itself writes that models can now create such exploits “with little human intervention”. Previously, this was the preserve of a handful of specialist teams. For operators, this means:
- More vulnerabilities in a shorter time: the number of critical vulnerabilities being disclosed is rising, and the patching cycle must keep pace.
- Faster attacks: Once a vulnerability is known, a patch diff can quickly turn into an attack.
- Legacy systems become a risk: Servers that are ‘just running’ and haven’t been rebooted for months are the preferred target.
What to do now
- Check the kernel version: Use `uname -r` to determine which kernel is running, and check it against your distribution’s security advisories. Please note: An installed update will only take effect after a reboot.
- Install updates immediately and restart: Where a patched kernel is available, follow these steps: install, schedule a restart, and check that everything is working. This also applies to container hosts, as containers share the host’s kernel.
- Use workarounds only as a temporary measure: Red Hat recommends an nftables rule that drops IPv4-TCP packets with IP options. According to Red Hat, this reduces the risk but does not completely prevent the attack. Disabling MPTCP alone is not sufficient.
- Monitor systems: Keep an eye out for unusual connection patterns, a high number of aborted handshakes and unexpected processes running with root privileges.
- Establish a permanent patching process: Define who monitors security bulletins, how quickly critical updates are applied, and when maintenance windows for reboots are scheduled.
Inaction can prove costly: What the GDPR requires of controllers
Under Article 32 of the GDPR*, controllers must implement appropriate technical measures in line with the state of the art. Anyone who leaves known critical vulnerabilities unpatched despite available updates risks, in the event of an incident, having to report the breach to the supervisory authority, facing fines and liability issues – particularly in the case of online shops handling customer data.
The right partner by your side: How elio supports you
When vulnerabilities are identified and exploited more quickly, response time is crucial. Many companies do not have their own team to monitor security alerts round the clock. This is exactly where we come in:
- Patch Check: We check your servers and shop systems for up-to-date kernel and software versions and show you where action is needed.
- Managed hosting and operations: Together with our hosting partner main cloud, we can, on request, handle updates, reboots within agreed maintenance windows and monitoring.
- Web Application Firewall: A WAF in front of your application provides additional protection at the application level. It does not replace kernel updates, but it does reduce the overall attack surface.
- Modernisation of legacy systems: We systematically migrate old servers and shop versions that no longer receive updates to current platforms.
Conclusion: AI changes the pace, not the basic rules
The new Linux vulnerability is not an isolated incident, but a foretaste of things to come. In the long term, AI makes software more secure because more bugs are found. In the short term, however, the pressure on every operator to react quickly is mounting. Those who know their systems well, install updates promptly and have a reliable partner at their side will reap the benefits and keep the drawbacks to a minimum.
Would you like to secure your Linux servers?
Whether it’s a patch check, managed hosting, a web application firewall or the migration of outdated systems: we’ll assess your servers and show you which approach best suits your requirements and budget.
Sources
- heise online: Another critical bug discovered in Linux TCP/IP – updates in the pipeline
- Anthropic: Discovering and exploiting vulnerabilities in critical, real-world software with Claude
- Red Hat: RHSB-2026-016, CVE-2026-98432 (30 October 2026)
- The Hacker News: Linux kernel TCP flaw with a CVSS score of 9.8 (29 October 2026)
- Borns IT Blog: Securepoint on the Linux IPv4 TCP vulnerability (31 October 2026)
