[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:cve-2026-98432-linux-kernel-tcp-what-to-do":3},{"post":4,"author":18,"controls":25,"vendors":54,"more":55},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":16,"updated_at":12,"reading_minutes":17},"cve-2026-98432-linux-kernel-tcp-what-to-do","analysis","CVE-2026-98432: a 9.8 Linux kernel flaw, a deferred fix and what to do in the gap","An AI-written remote root exploit, a bug in every kernel since 4.4, and vendors scoring it anywhere from 5.9 to 9.8. Ubuntu and RHEL have no fix yet. How to decide what to patch first and how to reduce the exposure while you wait.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fblog\u002Fai-4ee6c546-7fd1-43f2-9acd-02f62d04fbc5.png","A digital lockbox with a red vulnerability inside, surrounded by hesitant hands and a looming shadow.","Marcus Lenngren","2026-10-31T06:44:50.239+00:00","On 27 October Anthropic's Frontier Red Team said an unreleased Claude research model had written a working remote root exploit for Linux servers. No login, no user action: send packets to the right listener, and a shell command runs as root. The underlying bug is tracked as CVE-2026-98432, and it has been in the kernel since Linux 4.4.\n\nThe fix is upstream. The problem is that, as of 29 October, Ubuntu and Red Hat had not shipped it, and the vendors cannot agree how serious it is. That combination is where most companies get stuck, so this piece is about what to do in the gap.\n\n> **Key numbers**\n> - **9.8** CVSS from the Linux kernel CVE team, **5.9** from Red Hat's public page\n> - **Since Linux 4.4**, so nearly every maintained distribution kernel\n> - **48 minutes** to leak a kernel pointer in Anthropic's test, **5 more** to run a root command\n> - **Not in CISA's KEV catalogue**, and no public exploit code\n\n## What the bug is\n\nWhen a Linux server completes a TCP handshake over IPv4, the kernel hands the IP options stored with the pending connection to the new socket without copying them. Another CPU core can still be reading those options, for example to answer a resent SYN, while the first core frees them. The result is a use-after-free in the handshake code.\n\nThe upstream fix by Eric Dumazet, crediting Anthropic researcher Xinyang Ge, makes the kernel wait until every reader is done before freeing the options. It also closes a second path through TCP request socket migration (the `net.ipv4.tcp_migrate_req` setting or a BPF reuseport program). IPv6 is not affected by the main race, because its version of the function copies the options.\n\nAnthropic's exploit wins the race repeatedly to make the kernel send back extra memory until a reply contains a kernel pointer, which defeats KASLR. It then uses the same bug to overwrite a callback pointer and run a payload as root. A lost race only fails that one handshake and does not crash the server, so an attacker can simply keep trying.\n\nTwo caveats matter. Anthropic's exploit targets servers with a multipath TCP (MPTCP) listener, while the CVE record and the kernel fix do not mention MPTCP at all. And no outside team has reproduced the chain yet. Treat the exact attack path as Anthropic's claim, and the bug itself as real either way.\n\n## Why the scores disagree\n\nThe kernel CVE team scores it 9.8, assuming an unauthenticated attacker who sends a SYN with IPv4 Record Route or Timestamp options and resends it to hit the race. Red Hat's public page rated it Moderate, 5.9, citing how hard the race is to win and calling denial of service \"the practical worst case\". SUSE and Oracle say 8.1, Amazon 7.0, and Ubuntu uses 9.8 with High priority.\n\nA working root shell in a lab does not sit well with \"denial of service is the worst case\". The lesson is not about who is right. It is that a vendor's severity rating is an input, not a decision. If your patch policy says \"patch critical within 7 days, moderate within 90\", this bug lands in a different queue depending on which page your scanner reads.\n\n## Patch status\n\nThe fix ships in stable kernels 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10. Distribution status as reported by Cyber Kendra on 29 October:\n\n| Distribution | Status |\n|---|---|\n| Debian 12 and 13 | Fixed |\n| Oracle Linux 7 to 10 (UEK) | Fixed |\n| openSUSE Leap 16.0, SUSE Linux Micro 6.2 | Fixed |\n| Amazon Linux 2023, kernel 6.12 and 6.18 | Fixed |\n| SLES 15 SP4 to SP7, SLES 16.0 | In progress |\n| Amazon Linux 2, Amazon Linux 2023 default kernel | Pending |\n| Ubuntu 22.04, 24.04, 26.04, 26.10 | Vulnerable, fix in progress |\n| Ubuntu 16.04 to 20.04 | Vulnerable |\n| RHEL 8, 9, 10 and OpenShift 4 | Fix deferred |\n| RHEL 7 | Not affected |\n\nThis moves daily. Check your distribution's own tracker before you act on the table.\n\n## What to do this week\n\n### 1. Find the servers that matter first\n\nNot every Linux machine carries the same risk. Start with servers that accept TCP connections from the internet over IPv4: web front ends, load balancers, VPN and mail gateways, anything in a DMZ. Then check which of them run an MPTCP listener, since that is the path Anthropic exploited. Internal-only servers come next. Your [asset inventory](\u002Fcontrols\u002Fasset-inventory) and [attack surface management](\u002Fcontrols\u002Fattack-surface-management) tools should be able to answer \"which internet-facing hosts run which kernel\" in minutes. If they cannot, that is the finding.\n\n### 2. Patch where a fix exists, and reboot\n\nOn Debian, Oracle Linux, openSUSE and the fixed Amazon Linux kernels, install the update now. A kernel fix does nothing until the machine restarts on the new kernel, so check the running version after the reboot, not just the installed package. If you use live patching, confirm with your vendor that this CVE is covered before you skip the reboot.\n\n### 3. Where there is no fix yet, reduce the exposure\n\nFor Ubuntu and RHEL, while you wait:\n\n- **Turn off what you do not use.** If a server does not need multipath TCP, disable it (`net.mptcp.enabled=0`). This removes the path Anthropic exploited. It is not proven to close every path to the bug, so treat it as risk reduction, not a fix.\n- **Close the second path.** Make sure `net.ipv4.tcp_migrate_req` is off unless you rely on it.\n- **Filter IP options at the edge.** The scoring scenario needs a SYN carrying IPv4 Record Route or Timestamp options. Ordinary traffic almost never uses them, and many [firewalls](\u002Fcontrols\u002Ffirewall) can drop packets with IP options. Test it on one service first.\n- **Shrink the listener list.** Anything that does not need to be reachable from the internet should not be. Put administrative services behind a VPN or [zero trust access](\u002Fcontrols\u002Fzero-trust-access).\n- **Watch the handshakes.** A race-based exploit means many attempts. A sudden rise in failed handshakes or resets on a listening port is worth an alert in your [SIEM](\u002Fcontrols\u002Fsecurity-monitoring-siem).\n\n### 4. Write down the decision\n\nIf a server stays unpatched for weeks because the vendor deferred the fix, that is a risk someone should accept by name. Record the host, the compensating controls, the owner and the date you will look again.\n\n## The bigger point\n\nAnthropic says the model found the bug, chained it and wrote the exploit after a single prompt from a researcher. The same post covers 62 Chrome CVEs and working chains for Safari, Android and Windows, all reported to the vendors and fixed. Whatever you think of the claims, the direction is clear: the time from \"bug exists\" to \"working exploit\" is getting shorter, and the same tools are available to defenders.\n\nThat changes the arithmetic of [patch management](\u002Fcontrols\u002Fpatch-management). A process built on \"nobody will exploit a hard race condition in time\" is betting on attacker effort that is getting cheaper every month. The parts you control are how fast you know what you run, how fast you can reboot it, and what you do on the days when there is no patch yet.\n\n*Sources: [Cyber Kendra](https:\u002F\u002Fwww.cyberkendra.com\u002F2026\u002F10\u002Fcve-2026-98432-linux-kernel-tcp-flaw-ubuntu-rhel.html) on the CVE record, vendor scores and distribution status; [Cyber Security News](https:\u002F\u002Fcybersecuritynews.com\u002Flinux-kernel-flaw-root-commands\u002F) and [Cyber Kendra](https:\u002F\u002Fwww.cyberkendra.com\u002F2026\u002F10\u002Fanthropic-claude-exploit-chains-chrome-safari-linux.html) on Anthropic's research post of 27 October 2026.*",null,[],true,5,{"name":11,"slug":19,"same_as":20,"job_title":21,"photo_url":22,"short_bio":23,"linkedin_url":24},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[26,30,34,38,42,46,50],{"slug":27,"name":28,"problem":29},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",{"slug":31,"name":32,"problem":33},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":35,"name":36,"problem":37},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",{"slug":39,"name":40,"problem":41},"patch-management","Automated patch management","Known holes get closed in days, not months.",{"slug":43,"name":44,"problem":45},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":47,"name":48,"problem":49},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":51,"name":52,"problem":53},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[],[56,65,72],{"slug":57,"kind":58,"title":59,"excerpt":60,"cover_image_url":61,"cover_image_alt":62,"author_name":11,"published_at":63,"reading_minutes":64},"check-point-gaia-under-attack-php2shell-chained-to-root-for","rapid-alert","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","2026-11-13T11:18:49.874+00:00",3,{"slug":66,"kind":58,"title":67,"excerpt":68,"cover_image_url":69,"cover_image_alt":70,"author_name":11,"published_at":71,"reading_minutes":64},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","2026-11-13T08:52:08.367+00:00",{"slug":73,"kind":58,"title":74,"excerpt":75,"cover_image_url":76,"cover_image_alt":77,"author_name":11,"published_at":78,"reading_minutes":64},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","2026-11-12T08:02:16.435+00:00"]