---
title: "Linux Kernel TCP Flaw: Score Dispute and Fixes"
description: "Linux kernel TCP flaw scored 9.8 by the kernel team and 5.9 by Red Hat. Fixed versions, the listener detail, and the mitigation."
url: https://policycortex.com/blog/linux-kernel-tcp-98432-remote-root
sealed: 2026-10-31
register: blog/linux-kernel-tcp-98432-remote-root
records: 3
digest: sha3:e7f30b61dbeef601fba9d4b10a3ac0998e99f4fc19e6110465d04b78143592b1
---

# Linux Kernel TCP Flaw Scores 9.8, With a Scoring Dispute

Resources / Blog

A Linux kernel network flaw scored 9.8, but Red Hat rates it 5.9. The exploit needs a Multipath TCP listener, so check that detail first.

Leonard Esere · Sealed 2026-10-31 · Reading time 5 min

Filed under: [Linux kernel](https://policycortex.com/blog/tags/linux-kernel), [TCP](https://policycortex.com/blog/tags/tcp), [remote code execution](https://policycortex.com/blog/tags/remote-code-execution), [flaw remediation](https://policycortex.com/blog/tags/flaw-remediation), [patching](https://policycortex.com/blog/tags/patching)

**Summary**

- The kernel team scored the TCP flaw 9.8.
- Red Hat rates the same flaw 5.9.
- The public exploit needed a Multipath TCP listener.
- No confirmed exploitation in the wild is reported.

## What the flaw is

The record is [CVE-2026-98432](https://www.cve.org/CVERecord?id=CVE-2026-98432). It is a use-after-free flaw in Linux kernel network code. Use-after-free means code uses memory after it was freed. It sits in Internet Protocol version 4 (IPv4) and Transmission Control Protocol (TCP) code. The kernel team, acting as its own CVE Numbering Authority (CNA), scored it 9.8. That score uses Common Vulnerability Scoring System (CVSS) version 3.1. The attack needs no privileges and no user action. It works over the network. Affected kernels start at version 4.4.

The race is in tcp_v4_syn_recv_sock, which handles new connections. A retransmitted connection request on another processor can read freed memory. That read can turn into control of the system.

## How the exploit worked

The Anthropic Frontier Red Team tested this flaw. An unreleased artificial intelligence (AI) model built the exploit. It bypassed kernel address space layout randomization (KASLR). It ran commands as root in about 53 minutes total. The test server ran a Multipath TCP (MPTCP) listener. That listener detail matters for every defender.

## The scoring disagreement

Red Hat rates this flaw 5.9, much lower than 9.8. Red Hat points to a race that is hard to win. Other ratings call it Moderate or Important. Do not treat 9.8 as a promise of easy exploitation. Do not treat 5.9 as a reason to wait. The kernel team score reflects worst case impact. The Red Hat score reflects practical difficulty. Both scores describe the same flaw.

## What is not proven

No confirmed exploitation in the wild is reported. It is not in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog. Remote code execution is not publicly proven without an MPTCP listener. Do not claim exploitation that no source confirms.

## What to patch

Upstream fixed versions include:

- 5.10.272
- 5.15.223
- 6.1.190
- 6.6.159
- 6.12.113
- 6.18.56
- 7.2.10
- 7.3

Debian fixed Bookworm with 6.1.190-1. Debian fixed Trixie with 6.12.113-1. Ubuntu 22.04, 24.04, 26.04, and 26.10 fixes were still planned or in progress on October 30, 2026. Red Hat Enterprise Linux 8, 9, and 10 fixes were also planned or in progress. Check your distributor, not only the upstream number.

## A mitigation that helps now

CIQ published nftables guidance for this flaw. It blocks IPv4 TCP packets with IP options before vulnerable code runs. Disabling MPTCP alone is not enough. Go 1.24 turns MPTCP on by default for TCP listeners on Linux. Some Go services may enable it without knowing. Check listeners, not only settings you chose.

## The governance lesson

A kernel is the base of every Linux host. Its patch record is host evidence. An assessor will ask which hosts run which kernel. An assessor will ask which hosts run an MPTCP listener. A ticket marked done with no kernel number is a claim. Record the kernel before, the kernel after, and the patch date. Record the listener check beside the patch proof. PolicyCortex does not patch Linux kernels. PolicyCortex helps teams link proof to requirements.

## Sources

- [CVE-2026-98432](https://www.cve.org/CVERecord?id=CVE-2026-98432) record, CVE Program
- [CVE-2026-98432](https://nvd.nist.gov/vuln/detail/CVE-2026-98432) detail, National Vulnerability Database
- Anthropic Frontier Red Team exploit test, reported October 2026
- Red Hat rating of 5.9, reported October 2026
- CIQ nftables mitigation guidance, October 2026
- Debian fixed versions 6.1.190-1 and 6.12.113-1
- Original diagram by PolicyCortex

## Next step

Want kernel patch evidence linked to each host? See how [PolicyCortex](https://policycortex.com) collects it from live systems.

**Questions on this record**

**Q: What does the flaw do?**
A: It lets freed memory be read during connection handling.

**Q: Does it affect every Linux server?**
A: No. The public exploit needed a Multipath TCP listener.

**Q: Is it in the exploited catalog?**
A: No. It is not in the CISA exploited catalog.

**Q: What helps before a patch lands?**
A: Block TCP packets with IP options, per CIQ guidance.

## Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

- **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
- **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes.
- **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it.
- **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence.

### Further reading in this register

| Published | Entry | Reading |
|---|---|---|
| 2026-10-31 | [Ivanti Gateway Chain Grows With Two New Exploited Flaws](https://policycortex.com/blog/ivanti-kev-chain-second-stage-october-2026): CISA added two more Ivanti Connect Secure flaws to its exploited list on October 30, 2026. Together with an earlier flaw, they form a chain attackers already used. | 5 min |
| 2026-10-30 | [Cisco Firewall Flaw Lets an Attacker Crash SSL VPN Devices](https://policycortex.com/blog/cisco-asa-ftd-ssl-vpn-kev-dos): Cisco patches an exploited denial of service flaw in ASA and FTD firewalls. CISA added it to its exploited list on October 29, 2026, with a November 1 due date. | 4 min |
| 2026-10-29 | [Linux Kernel Fragnesia Flaw Joins the CISA Exploited List](https://policycortex.com/blog/fragnesia-linux-kernel-kev-chain): CISA lists a Linux kernel flaw as exploited. It chains with PHP flaws to reach root. Patch, reboot, and prove the running version. | 5 min |

Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

Dates of record

- **Published**: 2026-10-31
- **Last updated**: Unchanged since sealing
- **Author**: Leonard Esere
- **Record**: https://policycortex.com/blog/linux-kernel-tcp-98432-remote-root

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | HEAD | 787b4114e938 | 8a7648b38d5b |
| REC 0001 | BODY | 68c00eb0ae72 | 787b4114e938 |
| REC 0002 | RELATED RECORDS | e7f30b61dbee | 68c00eb0ae72 |

Head sha3:e7f30b61dbeef601fba9d4b10a3ac0998e99f4fc19e6110465d04b78143592b1. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.