By asahifile 
On October 15 the Linux kernel’s CVE team published CVE-2026-98432, a use-after-free in the IPv4 TCP handshake that any unauthenticated peer can reach. The score now attached to that record is 9.8. The same lines of code get 8.1 from SUSE and Oracle, 8.3 from Ubuntu, 7.0 from Amazon Linux, and 5.9 from Red Hat until it moved to 9.8 on October 30. That is a 3.9-point spread, 39% of the CVSS scale, on one bug. The spread is the story.
What the bug actually does
The kernel stores a half-open connection’s IPv4 options in a lightweight request socket, hands them to the full socket without copying when the handshake completes, then frees them while another CPU may still be reading them to build a SYN-ACK for a retransmitted SYN, or while the request is migrated (net.ipv4.tcp_migrate_req=1 or a BPF reuseport program). The fix reported by Anthropic’s Xinyang Ge turns two kfree() calls into kfree_rcu(): two files, one line each. Every kernel from 4.4 onward carries the bug; IPv6 is not affected by this first issue.
Anthropic’s Claude wrote a working exploit, and its timings matter: 48 minutes to leak a kernel pointer, five more to command execution. The catch is that the demonstrated exploit needs a multipath TCP listener, which the CVE record never mentions.
Six numbers, one bug
- Kernel CNA: 9.8 (CVSS 3.1, added October 24, nine days after publication).
- Red Hat: 9.8 Critical from October 30; 8.1 on October 29; 5.9 before that.
- SUSE and Oracle: 8.1, both Important.
- Ubuntu: 8.3, a CVSS v4.0 score, not comparable digit for digit with the v3.1 numbers beside it.
- Amazon Linux: 7.0, Important.
The low scores are not sloppiness; they price the same code for a narrower claim. Red Hat’s vector sets attack complexity to High, Ubuntu’s v4 vector sets attack requirements to Present, both ways of saying the race needs exact timing. They answer different questions, which is why the record’s number is a poor proxy for the number in your change calendar.
Two escalations that do not line up
The kernel team added 9.8 on October 24, three days before any exploit was public. Red Hat only reached 9.8 on October 30, the day after Anthropic’s write-up, and in between its own pages disagreed: the CVE page still carried Moderate 5.9 while the advisory file for the same CVE said Important 8.1. Amazon split the other way, shipping a fixed kernel6.12 package under ALAS2023-2026-3335 on October 29 while its CVE page still said the fix was pending.
The clock that decides your week
Build the other clock, from the merge commit. The fix reached the networking tree on October 5; counting to the day each vendor’s package appeared gives the lag in days: Debian trixie 11, Oracle Linux 11, Debian bookworm on 6.1 12, Debian’s 6.12 backport 17, Amazon Linux 6.18 19, Amazon Linux 6.12 24. Median across those six: 14.5 days. On October 30, 25 days after the merge and 15 after publication, Ubuntu and RHEL had shipped nothing and given no date.
Exposure is wider than the score tables imply, for a reason unrelated to the CVE. Since Go 1.24, Go programs open multipath TCP sockets by default for the sockets they listen on, the Go security team said on October 29, describing its own GODEBUG=multipathtcp=0 workaround as fragile. Red Hat’s stopgap is narrower still: an nftables rule that drops inbound IPv4 TCP packets whose header length exceeds five words. It cuts the reachable path and, in Red Hat’s own words, cannot fully prevent the bug.
When the verdict flips
Patch tonight if ss -Mlnp lists a multipath TCP listener on a host that takes untrusted traffic; if you run Go services built with Go 1.24 or later on a shared host; or if the machine is a Kubernetes node whose tenants share one kernel, where upgrading a container image changes nothing. Everything else can wait for the next maintenance window, provided the host takes no inbound IPv4 TCP from outside your trust boundary and runs no MPTCP listener.
That verdict flips four ways: Ubuntu or RHEL ships a kernel, making patching cheaper than an nftables rule; the promised IPv6 patch exposes a second path; an exploitation report appears; or the CVE joins a known-exploited list. The score will not tell you before the package does.
What to watch
- Ubuntu Security Notices and RHEL errata for the kernel packages, absent for both on October 30.
- The separate IPv6 patch the fix commit says is still coming.
- NVD’s analysis, still marked Received on October 29, which decides whether the 9.8 sticks.
- Whether 48 minutes to a kernel pointer holds up outside Anthropic’s lab.
Sources: CVE-2026-98432; Atlas Technical Consulting; The Hacker News; Red Hat RHSB-2026-016; Ubuntu tracker; Anthropic research.