What happened

• Anthropic said on October 27 that an unreleased AI model wrote a working exploit for CVE-2026-98432 giving a remote unauthenticated attacker root on servers with an MPTCP listener [S3].
• The flaw is a race-condition use-after-free in IPv4 TCP connection setup, introduced in Linux 4.4. The kernel CVE team scores it 9.8; Red Hat scores it 5.9 or 8.1 [S3][S4].
• Latest reporting says the race is triggered by connection requests carrying IPv4 Record Route or Timestamp options to any listening TCP port; the IPv6 main path is not affected [S1].
• Red Hat shipped fixed kernels for RHEL 8, 9 and 10 on November 1 and published an interim nftables mitigation. Ubuntu fixes are only in the opt-in -proposed pocket [S1].
• No vendor, CERT or kernel CVE team has reported attacks. A public proof-only crash PoC exists and does not implement code execution [S1].

Timeline

Detect

Linux kernel release inventory from boot logs · Linux syslog / kernel ring buffer forwarded to Splunk

index=* "Linux version" | rex "Linux version (?<kernel_release>\S+)" | stats latest(kernel_release) AS kernel_release latest(_time) AS last_seen BY host | convert ctime(last_seen)

FROM logs-* | WHERE message LIKE "*Linux version*" | GROK message "Linux version %{NOTSPACE:kernel_release}" | WHERE kernel_release IS NOT NULL | SORT @timestamp DESC | STATS kernel_release = TOP(kernel_release, 1, "desc"), last_seen = MAX(@timestamp) BY host.name | SORT last_seen DESC

A hit means: Shows the kernel each host last booted. Compare against the fixed builds (RHEL 8 4.18.0-553.182.1.el8_10, RHEL 9.8 5.14.0-687.64.1.el9_8, RHEL 10.2 6.12.0-211.72.1.el10_2) [S1]. Ubuntu 22.04, 24.04 and 26.04 hosts are unfixed unless running the -proposed kernels [S1].

Kernel oops or panic in TCP code · Linux syslog / kernel messages

index=* ("BUG:" OR "Oops" OR "general protection fault" OR "Kernel panic") (tcp OR inet_csk OR mptcp) | stats count min(_time) AS first max(_time) AS last BY host | convert ctime(first) ctime(last)

FROM logs-* | WHERE (message LIKE "*BUG:*" OR message LIKE "*Oops*" OR message LIKE "*general protection fault*" OR message LIKE "*Kernel panic*") AND (TO_LOWER(message) LIKE "*tcp*" OR TO_LOWER(message) LIKE "*inet_csk*" OR TO_LOWER(message) LIKE "*mptcp*") | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name | SORT count DESC

A hit means: A kernel crash referencing TCP code on a listening host. This can be consistent with the public crash PoC [S1], but it is not proof of exploitation. Correlate with inbound SYNs carrying IPv4 options at the crash time.

Verify

• Confirm a crash coincides with inbound IPv4 TCP SYNs carrying Record Route or Timestamp options to a listening port, using packet capture from the host or network tap [S1].
• SANS ISC describes tshark, tcpdump, Suricata and Zeek methods for spotting MPTCP (TCP option 30) traffic. These show MPTCP use, not exploitation [S5].
• Benign look-alikes: legitimate MPTCP traffic (Go 1.24+ services enable MPTCP listeners by default) [S4]; unrelated kernel bugs or driver faults in the networking stack.
• Read the counters on Red Hat's nftables rule if deployed: a non-zero drop count means IPv4 TCP packets with IP options reached the host. Diagnostic tools and some legacy traffic also use IP options.

Scope

Affected

• Linux kernel IPv4 TCP path present since Linux 4.4, including RHEL 8, 9, 10 and Ubuntu 22.04, 24.04, 26.04 [S1][S3]
• Rocky Linux reported vulnerable or awaiting fixes as of November 2 [S4]

Only if

• The host accepts IPv4 TCP connections on a listening port [S1]
• An attacker can deliver IPv4 TCP SYNs carrying Record Route or Timestamp options to that port [S1]

Not affected if

• Only the IPv6 main path is reachable; per source it is not affected [S1]
• Running the fixed RHEL kernels listed in fixed_in [S1]

Fixed in: RHEL 8: 4.18.0-553.182.1.el8_10 (RHSA-2026:93414); RHEL 9.8: 5.14.0-687.64.1.el9_8 (RHSA-2026:93412); RHEL 10.2: 6.12.0-211.72.1.el10_2 (RHSA-2026:93413); Ubuntu fixes only in -proposed (22.04: 5.15.0-203.213, 24.04: 6.8.0-149.149, 26.04: 7.0.0-43.43) [S1]

Enumerate

• Running kernel release on every Linux host, VM, appliance and container host (uname -r)
• Internet- and partner-facing IPv4 TCP listeners on Linux
• Services with MPTCP listeners, including Go 1.24+ binaries [S4]
• Vendor appliances built on Linux 4.4+ kernels and their vendors' fix status
• Hosts where containers on the same host can reach each other, since the nftables rule does not cover that traffic [S1]

Contain

• On RHEL, apply the fixed kernels from the November 1 advisories [S1]. A reboot is required; capture memory first on any host with a suspicious crash, because a reboot destroys volatile evidence and cannot be undone.
• Where patching must wait (including Ubuntu), deploy Red Hat's nftables rule: table inet cve_2026_98432 { chain input { type filter hook input priority -310; policy accept; ip protocol tcp ip hdrlength > 5 counter drop } } [S1]. It is reversible, but it only blocks the known trigger, and traffic between containers on the same host can bypass it [S1].
• Consider dropping IPv4 packets with IP options at perimeter devices for exposed Linux services; verify no legitimate dependency first.
• Decide whether to deploy Ubuntu -proposed kernels after testing, or wait for the stable pocket [S1].

Eradicate

• Root cause is the kernel use-after-free; the only removal is running a fixed kernel [S1].
• The sources describe no persistence or post-exploitation tooling. If compromise is suspected, rebuild the host rather than clean it.

Recover

• Validate the running kernel (not just the installed package) matches the fixed build after reboot [S1].
• Keep the nftables counters in place on unpatched hosts and alert on increments.
• Monitor for kernel crashes in TCP code and for unexpected root processes on exposed Linux services.

Re-enter the loop when

• Any vendor, CERT or the kernel CVE team reports in-the-wild exploitation
• A public PoC moves from crash to code execution (current PoC is proof-only) [S1]
• Ubuntu fixes move from -proposed to the stable pocket, or Rocky and other distros publish fixes [S1][S4]
• Red Hat revises its advisory or mitigation, or a bypass of the nftables rule beyond container-to-container traffic is reported
• The trigger is confirmed broader than IPv4 Record Route/Timestamp options, or the IPv6 path is found affected

Debrief

• Record time from the November 1 RHEL fix to full patch coverage, and the count of hosts on Ubuntu awaiting stable fixes.
• Record where the nftables mitigation was used and for how long.
• Note asset inventory gaps found for Linux appliances and container hosts.
• Gap: sources disagree on whether an MPTCP listener is required [S3][S4] or any IPv4 TCP listener is reachable [S1].
• Gap: severity scores conflict (9.8 vs 5.9/8.1) and an early report said the CVE record did not clearly match Anthropic's description [S2][S3].

Detection coverage — checked automatically

Checked automatically 2026-11-10 11:17Z from public sources: 11 published, 25 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2026-33096 — Anthropic reports unreleased AI model built lab-only exploit chains for Chrome, Safari, Android, Windows and Linux; all; CVE-2026-98432 — Anthropic reports unreleased AI model built lab-only exploit chains for Chrome, Safari, Android, Windows and Linux; all. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-33096

vuln:CVE-2026-98432

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD has not published CPE configurations for these CVEs yet, so only the CVE query is exact; the product queries use the name the campaign gives (SANS ISC, Multipath TCP) and are replaced by NVD's spelling at the daily re-check once it names the software.

Also tried under the name the card uses, nothing matched on Shodan: product:"SANS ISC", http.component:"SANS ISC", product:"Multipath TCP", http.component:"Multipath TCP", host.services: (software.product = "SANS ISC"), host.services: (software.product = "Multipath TCP").

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 11:17Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• Is an MPTCP listener required, or is any IPv4 TCP listener reachable? Earlier reports [S3][S4] and today's report [S1] differ.
• Which severity score applies: the CNA 9.8 or Red Hat 5.9/8.1 [S3][S4]?
• S4 (November 2) says RHEL was still awaiting fixes while S1 says fixes shipped November 1. Was S4 written before the release?
• When will Ubuntu fixes reach the stable pocket, and what is the status for Debian, SUSE, Rocky and Linux-based appliances?
• No primary Red Hat, Ubuntu or kernel CVE record is in the input. Fixed builds and the nftables rule should be checked against the RHSAs directly.
• Has Anthropic released technical details of its exploit, and does it rely on conditions beyond those in S1?

Sources

• [S1] https://thehackernews.com/2026/11/red-hat-patches-98-rated-linux-tcp-rce.html · The Hacker News
• [S2] https://thehackernews.com/2026/10/anthropics-unreleased-ai-model-chains.html · The Hacker News
• [S3] https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html · The Hacker News
• [S4] https://www.bleepingcomputer.com/news/security/critical-linux-kernel-flaw-allows-remote-root-attacks-on-mptcp-servers/ · BleepingComputer
• [S5] https://isc.sans.edu/diary/rss/33482 · SANS ISC

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.