A Kernel Race Becomes Remote Root in 53 Minutes, in a Bite

A use-after-free race in the Linux kernel IPv4 TCP handshake turns into remote root in 53 minutes, because a failed attempt costs the attacker nothing.

• CVE-2026-98432 is scored 9.8 by the kernel CVE team. Anthropic built the exploit with an unreleased Claude model, and it needs no user interaction.
• Stage one reads a kernel pointer in 48 minutes and defeats KASLR. Stage two overwrites a callback pointer and reaches a shell as root five minutes later.
• Go 1.24 made MPTCP the default for TCP listeners on Linux, so a modern Go service is an MPTCP listener unless multipathtcp=0 is set.
• Anthropic says the bug is patched upstream and backported to maintained stable branches. No exploitation in the wild has been reported.
• The kernel advisory says tcp_v4_syn_recv_sock hands a socket option to a child socket without copying it, so a retransmitted SYN frees memory a second CPU is still reading.

The full analysis covers why a free retry loop removes the window severity ratings assume, and what to check on your own nodes. Read the full analysis.