https://karmine05.github.io/dirtyfrag-blog/tags/tcp/ Recent content in Tcp on karmine's notes Hugo -- gohugo.io en dhruv@fleetdm.com (Dhruv Majumdar) dhruv@fleetdm.com (Dhruv Majumdar) © 2026 karmine's notes Fri, 30 Oct 2026 14:00:00 -0400 https://karmine05.github.io/dirtyfrag-blog/posts/cve-2026-98432-linux-tcp-uaf-fleet/ Fri, 30 Oct 2026 14:00:00 -0400 dhruv@fleetdm.com (Dhruv Majumdar) https://karmine05.github.io/dirtyfrag-blog/posts/cve-2026-98432-linux-tcp-uaf-fleet/ CVE-2026-98432 is a use-after-free in the Linux kernel’s IPv4 TCP connection setup, present since 4.4 and scored 9.8 by the kernel CNA. Anthropic says its AI model built a no-credentials root exploit against a host with a multipath TCP listener. Debian, Oracle and Amazon Linux have fixed kernels; Ubuntu and RHEL do not. This post covers the mechanism, who is exposed, when to rush, how Fleet finds the hosts, an interim mitigation script, and two policies that apply it on check-in and remove it once the patched kernel is running.