めーぷる

🚨 Critical Linux kernel TCP flaw enables remote root code execution; CVE-2026-98432 A race condition in the Linux kernel’s IPv4 TCP implementation can trigger a use-after-free before application authentication, potentially allowing an unauthenticated remote attacker to leak kernel memory, corrupt memory or crash the system. Anthropic says Claude developed a working exploit that executed attacker-chosen commands as root against Linux servers with a Multipath TCP listener. The exploit took approximately 53 minutes to complete during testing and has not been publicly released. ⠀ • CVSS: 9.8 Critical, according to the Linux kernel CVE team • Affected: Linux kernels beginning with version 4.4 • Fixed: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3 • Attack requirements: Network access, no credentials and no user interaction • Exploitation status: No known attacks in the wild ⠀ Ubuntu and Red Hat Enterprise Linux had not released corrected kernel packages as of October 29. Debian, Oracle Linux, Amazon Linux and SUSE have released fixes for at least some affected branches. Distribution severity ratings differ substantially. Red Hat rates the flaw 5.9 because it considers the race difficult to win and describes denial of service as the most likely practical impact.