A critical vulnerability in the Linux kernel’s TCP networking code, tracked as CVE-2026-98432, is affecting widely used distributions including Ubuntu and Red Hat Enterprise Linux (RHEL). The flaw carries a CVSS score of 9.8 out of 10, as rated by the Linux kernel’s own CVE numbering team, reflecting its potential for remote, unauthenticated exploitation.

According to the source report, the vulnerability resides in the kernel’s handling of TCP connections and could allow a remote attacker with no credentials to execute commands as root on affected Linux servers. That combination of network-facing exposure, no authentication requirement, and full root-level compromise places the flaw among the most severe classes of kernel vulnerabilities.

AI-Generated Exploit

In a notable development, Anthropic disclosed on October 27 that its AI model was able to write a working exploit leveraging this flaw. The disclosure underscores a growing concern in the security community: that advanced AI models can now assist in, or independently produce, functional exploit code for serious kernel-level vulnerabilities, potentially lowering the barrier for threat actors to weaponize newly disclosed bugs.

Who Is Affected

Because the vulnerable code lives in the Linux kernel’s TCP stack, the issue is not limited to a single distribution. Ubuntu, RHEL, and other Linux distributions that ship the affected kernel code are all exposed, making this a broad, cross-distribution risk for enterprise and cloud environments that rely on Linux servers.

What Security Teams Should Do

  • Identify all Linux systems running kernel versions that include the vulnerable TCP code path.
  • Prioritize patching for internet-facing and otherwise network-exposed Linux servers given the remote, unauthenticated attack vector.
  • Monitor vendor advisories from Ubuntu, Red Hat, and other distribution maintainers for patched kernel releases.
  • Treat this disclosure as high urgency given the confirmed existence of working exploit code.

Given the critical severity rating, the remote unauthenticated attack path, and confirmation that functional exploit code already exists, organizations running affected Linux kernels should treat patching as an immediate priority.