Linux suppliers are releasing security updates for CVE-2026-98432, a critical flaw that could let an attacker take control of an affected server without logging in. On 27 October 2026, Anthropic reported that an unreleased Claude research model helped discover the vulnerability and produce working attack code.
Red Hat rates the flaw Critical, with a severity score of 9.8 out of 10, after raising its classification on 30 October.
Why this matters for website owners
The problem sits in the Linux kernel, the central part of the operating system that manages a server's hardware and network connections. It is below the website itself, so updating a content management system or its plugins will not repair it.
The bug affects how incoming IPv4 TCP connections are established. TCP supports many website, email and hosting control-panel connections. A timing clash between processor cores can cause the kernel to use memory that has already been released, an error known as use-after-free.
According to Red Hat's security bulletin, an attacker needs network access but no account, password or user action. Exploitation could crash an affected server or allow unauthorised commands. The issue affects multiple Linux variants used for hosting, including Red Hat Enterprise Linux, AlmaLinux, Ubuntu and Debian.
What Anthropic demonstrated
Anthropic says its demonstration took approximately 53 minutes: 48 minutes to obtain information from the server's memory, followed by five minutes to execute commands with full administrator privileges. This was the time taken by the attack, not the time spent finding the bug or writing the exploit.
The demonstrated attack depended on Multipath TCP, or MPTCP, a feature that lets a connection use several network paths. It is normally disabled on Red Hat-family systems, but software built with Go 1.24 or later can select it automatically for incoming connections where the operating system permits it.
The Go security team warns that the underlying defect also exists in ordinary TCP. Servers without MPTCP may therefore still be vulnerable. Disabling that feature is not a complete fix.
At the time of writing, CloudLinux reports no public exploit code or known attacks in the wild, and says its developers have not reproduced the remote attack. Anthropic's demonstration is not evidence of widespread compromise.
The research shows how AI can help defenders investigate serious weaknesses and demonstrate their impact. The same capabilities could help attackers analyse published fixes and develop attacks sooner. That increases the pressure to patch promptly, without establishing that criminals are already using this particular exploit.
Patch availability is changing
Red Hat began releasing fixed kernels on 1 November. AlmaLinux added fixes to its regular update repositories on 2 November, and Debian has published corrected packages for its affected supported releases.
At the time of writing on 2 November 2026, Ubuntu's tracker still lists affected kernels as vulnerable, with fixes in progress. KernelCare reports live patches released for supported Red Hat-family 8 and 9 systems and Debian 13; version 10 patches remain in testing. Coverage depends on the particular kernel and delivery channel.
A conventional kernel update requires a restart before the fix takes effect. An applicable live patch can repair the running kernel without restarting. Temporary firewall filtering of IPv4 packets carrying unusual optional information can reduce exposure, but does not replace patching.
What we have done
On the day the advisory reached us, we checked both hosting servers, confirmed that MPTCP was not enabled and applied the recommended interim firewall protection.
We installed the fixed kernel on the day it became available and restarted the servers overnight, outside business hours, keeping customer websites online during the working day. We have no indication that either server was compromised. Customers do not need to do anything.
Anyone running their own Linux server should verify that it is running the patched kernel after a restart, or that a suitable live patch is active. Do not rely on the MPTCP setting alone.
