TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8

Linux kernel vulnerability CVE-2026-98432 allows remote, unauthenticated attackers to execute code as root on vulnerable Linux servers. The bug, a use-after-free in the IPv4 TCP handshake, has a CVSS 3.1 score of 9.8, Critical. The issue affects Linux kernels 4.4 and later, including those from Ubuntu and Red Hat, and is not fixed in all affected distributions. A proof-of-concept exploit was written by Anthropic's Claude model, which can run commands as root on Linux servers with a multipath TCP listener.