CVE-2026-98432: Linux TCP Use-After-Free. Find It, Mitigate It, Auto-Remove It with Fleet
·1620 words·8 mins
CVE-2026-98432 is a use-after-free in the Linux kernel’s IPv4 TCP connection setup, present since 4.4 and scored 9.8 by the kernel CNA. Anthropic says its AI model built a no-credentials root exploit against a host with a multipath TCP listener. Debian, Oracle and Amazon Linux have fixed kernels; Ubuntu and RHEL do not. This post covers the mechanism, who is exposed, when to rush, how Fleet finds the hosts, an interim mitigation script, and two policies that apply it on check-in and remove it once the patched kernel is running.