CVE-2026-98432 Response Playbook: Triage, Mitigate and Patch an 11-Year Linux Kernel Remote Root Flaw

If your estate includes internet-facing Linux hosts, the defect behind CVE-2026-98432 is best handled as a patch-window problem this week, not as another AI headline. Anthropic recently disclosed that an unreleased Claude model located it during systematic testing: a use-after-free in the kernel's IPv4 TCP handshake path that survived 11 years of review and carries a score of 9.8, the highest danger band for remote code execution. The model did not stop at the bug — it produced a working two-stage chain that reaches root in roughly 53 minutes, and a failed attempt leaves the target running so an attacker can try again. That combination is what makes this operational rather than theoretical: network reachability is the only prerequisite. What follows is a triage sequence, an exposure checklist, the mitigation that buys time, the traps we keep seeing and the decisions owners should take now.

The defect, phrased the way an operator needs it

The offending code was committed in October 2015 and entered the tree with the 4.4 kernel, which is why the affected window covers roughly a decade of production deployments. Mechanically, the handshake path and the SYN retransmission path disagree about who owns the IPv4 options cached on a socket: while one CPU handles a retransmitted SYN, another can release memory the connection-response code is still reading.

The kernel CVE team characterises the result as a network-reachable flaw requiring no privileges and no interaction. There is no account to steal, no password to guess and no link for a user to click — a routable path to a listening service is enough to progress toward remote execution as root.

Dimension	What it means in your environment
Severity	9.8, rated Critical by the kernel CVE team; network reachable, no privileges, no user interaction
Affected since	Code committed October 2015, shipped with the 4.4 kernel
Chain shape	Two stages: about 48 minutes to defeat kernel address randomisation, then about 5 minutes to execute arbitrary commands as root — roughly 53 minutes end to end
Failure behaviour	A failed attempt does not crash the host, so attempts repeat without a panic as the signal
Public exploit code	Anthropic states the generated exploit was not published
Main amplifier	Listeners that negotiate MPTCP, including Go 1.24 and later defaults on Linux
Remediation	Patched and rebooted kernel only; configuration changes reduce exposure but do not close the bug

Read the 48-minute stage as a detection window, not a curiosity

Anthropic's own technical writing on model cyber capabilities frames kernel exploitation as a chaining problem: KASLR randomises where kernel code and data sit on every boot, so a write primitive alone is mostly blind, and reliable privilege escalation normally needs a leak that recovers the layout first. The reported chain for CVE-2026-98432 matches that pattern — 48 minutes spent on address randomisation, then 5 minutes to root.

For defenders, that timing detail has a useful implication: 48 minutes is not instantaneous. A host under this kind of attempt is generating an abnormal run of connection attempts against a listener over a long, continuous window, while a chain that fails or succeeds silently produces no crash. Commercial telemetry already treats the pattern as detectable — Datadog publishes a default rule that pairs a host whose configuration exposes CVE-2026-98432 with a sustained burst of TCP SYNs inside the evaluation window. If "did the kernel panic?" is your only host-level question, you will not see the attempt at all.

Patch board: what is fixed, what is not, what to do in between

Upstream landed the fix on October 15. The affected stable branches were closed in 5.10.272, 6.1.190, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7, and Debian, Red Hat and Amazon Linux have since released patched kernels.

Ubuntu is the outlier. As of November 1, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10 are still listed as affected with the fix in development. Any internet-exposed Ubuntu estate therefore sits in a genuine risk window, and the honest instruction is: shrink the reachable surface today, patch the hour the advisory lands, then re-verify.

Track	Status	Operator action
Upstream stable	Fixed October 15 in 5.10.272, 6.1.190, 6.12.113, 6.18.56, 7.2.10, 7.3-rc7	Rebuild custom and embedded kernels from these points
Debian	Patched kernels released	Apply through the normal security update channel
Red Hat	Patches released; Red Hat's RHEL 8 networking documentation notes MPTCP is disabled by default	Confirm nobody enabled it deliberately before de-prioritising
Amazon Linux	Patches released progressively	Match the advisory to your architecture and node group
Ubuntu	22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 affected as of November 1; fix in development	Mitigate, enrol live patching if already subscribed, reboot on schedule
Custom / CI images	Often outside vendor advisories	Diff your booted kernel against upstream, then rebuild golden images

Two interim options deserve a decision rather than a reflex. If your Ubuntu fleet is enrolled in Canonical's live patching service, verify coverage explicitly with canonical-livepatch status --verbose; the Ubuntu Pro client documentation is clear that the service applies to Canonical-released kernels and must already be enabled. Alternatively, some vendors published fixed kernels in testing repositories first — AlmaLinux documented exactly that for this CVE on October 30 — which is a legitimate route if your change policy allows a security-testing ring.

Triage sequence: run this on every Linux host

1. Identify the booted kernel, not the installed package. Run uname -r. Vendors backport fixes into their own version strings, so compare against your distribution advisory rather than only against the upstream numbers above — and remember that a host updated but never rebooted still runs the vulnerable kernel.
2. Check whether MPTCP is enabled. sysctl net.mptcp.enabled. A value of 0 means the kernel will not set up new multipath sockets.
3. Prove whether a listener actually uses it. ss -Mln lists MPTCP listening sockets. An enabled feature is not the same as an exposed service; you need both to call a host genuinely reachable, and neither alone is proof of safety.
4. Hunt implicit opt-ins. The Go 1.24 release notes state that listener configuration uses MPTCP by default on systems where it is supported, currently Linux. Every Go daemon you compile with 1.24 or newer is a candidate, including sidecars, operators, debug endpoints and containers.
5. Map reachability. Public IPs, flat corporate VLANs, CI runners, jump hosts, edge and CDN origin nodes, and anything that terminates partner traffic. No-authentication kernel flaws tend to be reached from inside the perimeter first.
6. Rank and assign. Reachable plus MPTCP listener plus unpatched goes to the front of the queue; reachable plus patched closes the ticket; internal-only plus unpatched is scheduled inside your critical-CVE SLA.
7. Verify after remediation. Reboot, re-run uname -r and ss -Mln, and attach the output to the change record as audit evidence.

Exposure checklist

• Booted kernel older than the fixed build for your branch, with no live patch applied
• net.mptcp.enabled returning 1 on hosts whose services never need multipath
• Any Go 1.24+ binary listening on a routable interface
• Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS or 26.10 systems facing the internet
• Hosts reachable from office or CI networks without east-west filtering
• Inventory that records package versions but not the kernel actually running
• Golden images and container base images rebuilt from an unfixed kernel package
• Monitoring without a per-listener SYN-rate or connection-churn signal
• Kernel reboots gated behind a monthly approval cycle

The time-buying mitigation — and the sentence you must not skip

Two switches reduce how easily the flaw is reached. Kernel-wide: sudo sysctl -w net.mptcp.enabled=0, persisted in a drop-in such as /etc/sysctl.d/90-disable-mptcp.conf so it survives a boot — the same mechanism Oracle Linux documents and AlmaLinux recommends in its advisory. Application-level: GODEBUG=multipathtcp=0 turns the Go default off inside the process without touching the host, which matters for container fleets you cannot sysctl individually.

Neither is a fix. The defect sits in the IPv4 TCP handshake code, so disabling MPTCP removes one amplifier rather than the bug itself, and a runtime sysctl reverts on the next boot unless persisted — images built before your change will silently roll it back. Log mitigation as bought time with a named owner and an expiry date, not as a closed finding.

Common misconceptions

"We never enabled MPTCP, so we are not exposed"

Defaults are what bite. Go 1.24 and later enable MPTCP on Linux listeners with no developer decision, and distribution defaults differ from one another. Confirm the live value with sysctl and ss -Mln instead of reasoning from intent.

"We disabled MPTCP, so this is closed"

Disabling MPTCP lowers risk but cannot eliminate a kernel-level defect in the TCP path. Close the finding only on a patched, rebooted kernel.

"The update ran, so the host is fixed"

Package installed, service restarted and kernel booted are three separate facts. Verification is uname -r after the reboot window, not the package manager log.

"The exploit code is not public, so there is nothing to respond to"

Anthropic confirms the generated exploit was not published, and that is material. But the disclosure also shows how long a defect can hide — 11 years here — and how quickly a usable chain follows once someone, human or model, starts looking systematically.

"A 9.8 score means it is being exploited in the wild"

Severity describes impact and preconditions, not observed activity. Prioritise from your own reachability data and vendor advisories; reserve confirmed-exploitation language for evidence you can hand to a customer.

"Live patching removes the need to reboot"

Only conditionally: an enrolled subscription, a supported vendor kernel and a matching build. Use it as a bridge with a reboot scheduled, not as a permanent answer.

Action advice by role

Platform and infrastructure owners

Freeze the mitigation decision for one sprint: which hosts get net.mptcp.enabled=0 persisted today, which can absorb a testing-repo kernel, and which need a reboot window this week. Add booted-kernel age, not package version, to the golden-path dashboard, and treat east-west filtering as a control for services that were never meant to be reachable from internal client subnets.

Application developers

Audit the Go toolchain version used in CI, not only what runs on the host. Where multipath is not required, set GODEBUG=multipathtcp=0 explicitly and record the choice in the service catalogue. Strip debug and profiling listeners from production images; a port nobody documents is a port nobody patches in time.

Security leadership and risk owners

Three decisions this week: a separate, shorter SLA for kernel CVEs that are network reachable and require no credentials or interaction; a named owner for the Ubuntu patch gap while the fix is in development; and a report line on time-to-reboot, because that metric converts a patched package into an actually safe host. The board-level framing is simple — discovery is no longer the bottleneck, delivery is.

FAQ

Is every host running a 4.4-or-later kernel remotely exploitable?

No. The condition to chase is an unpatched kernel plus a reachable TCP path, and exposure is widest where listeners negotiate MPTCP. Internal-only hosts are a scheduling problem, not a midnight incident.

Which releases should I worry about most?

Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10 remained flagged as affected as of November 1, so internet-facing Ubuntu systems are the mitigation priority while Debian, Red Hat and Amazon Linux hosts are patch-and-reboot work.

Does the IPv4 detail help me if I run dual-stack?

Not in any way you should rely on. The defect is described in the IPv4 TCP handshake path, and protocol gymnastics are not a substitute for the patched kernel.

Do I need to change application code?

Only where a framework opted you in silently. For Go 1.24+ services, decide explicitly between the host sysctl and the process-level GODEBUG=multipathtcp=0, and document the decision.

Can I prioritise from the scanner's CVSS feed alone?

Use the score for banding, then override it with reachability, the no-privilege and no-interaction profile, and the retry-without-crash behaviour that makes silent attempts likely.

What this incident changes about vulnerability management

The uncomfortable data point is the timeline: code committed in October 2015, invisible for 11 years, a two-stage chain produced during testing, upstream fix on October 15 — and yet on November 1 a major distribution still had none. Discovery is being commoditised; delivery is where estates actually fail. Shorten the gap between "fixed upstream" and "rebooted in production", keep an inventory that answers which host listens and which kernel runs, and stop treating a Critical kernel CVE as a package-manager task.

For now the practical summary is narrow: patched kernels exist, one widely used distribution has not published its fix, disabling MPTCP is time bought rather than risk retired, and an AI-assisted finding that sat dormant for 11 years should reset how long you let kernel updates sit unbooted.

Sources referenced in this guide

• Go 1.24 release notes, MPTCP enabled by default for listeners on Linux — https://go.dev/doc/go1.24
• Go project issue tracking the MPTCP default and the GODEBUG switch — https://github.com/golang/go/issues/82717
• Oracle Linux documentation on disabling MPTCP at runtime — https://docs.oracle.com/en/operating-systems/oracle-linux/mptcp/mptcp-disabling_mptcp.html
• Red Hat Enterprise Linux 8 networking guide, Multipath TCP defaults — https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-multipath-tcp_configuring-and-managing-networking
• AlmaLinux advisory post on fixed kernels available in testing — https://almalinux.org/blog/2026-10-30-cve-2026-98432/
• Ubuntu Pro client documentation on managing Livepatch — https://ubuntu.com/pro-client/docs/en/latest/howtoguides/enable_livepatch/
• Datadog default detection rule for exploitation attempts against CVE-2026-98432 — https://docs.datadoghq.com/security/default_rules/def-000-mke/
• Anthropic publication on model cybersecurity capabilities and KASLR chaining — https://www.anthropic.com/news/mythos-preview
• Independent coverage of distribution status — https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html

Written by James Hartley, IT Insights security desk. Found a gap in your own remediation notes or want the checklist adapted to your estate: contact@itinsights.com.