Linux kernel vulnerability CVE-2026-98432 drew fresh warnings on October 30 as BleepingComputer reported that Anthropic had demonstrated unauthenticated remote root access to servers exposing Multipath TCP listeners. CIQ also published mitigation guidance that day for affected Linux systems awaiting patches. BleepingComputer reported no confirmed exploitation in the wild.

Anthropic disclosed its research on October 27, describing an exploit developed with an unreleased Claude model. The company said the flaw had been patched upstream and backported to maintained stable kernel branches. Distribution updates remain a separate issue: CIQ said no fixed kernel had been published for the specific RLC Pro variants covered by its October 30 advisory.

According to the vulnerability record reproduced in Debian’s security tracker, concurrent handling of TCP connection requests can leave code reading IP options after their memory has been freed. This use-after-free condition affects the IPv4 TCP connection setup path. CIQ says unauthenticated peers can reach the flaw through TCP packets carrying IPv4 options.

Anthropic’s proof of concept first leaked a kernel pointer to bypass address randomization, then redirected execution to run a chosen command as root. The company reported 48 minutes for the leak and another five minutes for command execution. That demonstration required a Multipath TCP listener; CIQ cautions that the underlying vulnerable path remains reachable through ordinary TCP even when MPTCP is disabled.

Debian’s tracker lists fixes in Linux source package versions 6.1.190-1 for Bookworm and 6.12.113-1 for Trixie. CIQ’s advisory covers Rocky Linux 8, 9 and 10 and related commercial variants, with patch status dependent on the specific release. Its guidance directs administrators to check vendor advisories and confirm that the running kernel contains the fix.

For systems awaiting updates, CIQ recommends an interim firewall rule blocking IPv4 TCP packets that carry IP options before they reach the TCP stack. It warns that this also drops legitimate traffic using those options and should first be tested on a non-production host. Once a fixed kernel is available, CIQ advises installing it, rebooting, verifying the running version and removing the temporary mitigation.