A Linux kernel TCP flaw tracked as CVE-2026-98432 scores 9.8 out of 10 and affects Ubuntu, RHEL, and more. Anthropic says its AI model already wrote a working root exploit.
A single flaw in the Linux kernel's TCP code just earned a 9.8 out of 10 on the CVSS scale. That's about as close to a perfect storm as security ratings get. The bug, tracked as CVE-2026-98432, touches Ubuntu, Red Hat Enterprise Linux (RHEL), and a long list of other distributions running on servers across the United States and beyond.
Here's the part that makes you sit up straight: the kernel's own CVE team is the one handing out that 9.8 score. When the people who maintain the code tell you it's bad, you listen.
### What Actually Happened
On October 27, Anthropic said its AI model wrote a working exploit for this flaw. Not a proof of concept that crashes a test box — an exploit that lets a remote attacker with zero credentials run commands as root. Root. On Linux servers. From the outside.
Think about what that means for a second. Someone with no login, no password, no foothold of any kind could potentially take full control of a machine. That's the scenario every sysadmin has nightmares about, and it's now attached to a real CVE number.
### Why the TCP Layer Matters So Much
TCP is the plumbing of the internet. Every web request, every database connection, every API call rides on it. When the flaw lives in that layer, the attack surface isn't some obscure corner of a system — it's the front door.
- Affects Ubuntu, RHEL, and other major distributions
- Rated 9.8 out of 10 by the kernel's own CVE team
- Exploitable remotely with no credentials required
- Grants root-level command execution
That combination is rare, and it's exactly why the score landed where it did.
### The AI Angle Changes the Conversation
We've gotten used to AI helping defenders triage alerts and write detection rules. Now we're watching a model generate a functional exploit for a critical kernel bug. That's a shift, and it's worth being honest about.
> "The gap between disclosing a vulnerability and having a weaponized exploit in the wild used to be measured in weeks. It's shrinking fast."
For anyone running Linux infrastructure — hosting providers, e-commerce backends, SaaS platforms — the practical takeaway is simple: patch windows just got shorter. If you've been treating kernel updates as something to schedule for next month, that habit is now a liability.
### What You Should Do Right Now
First, check which kernel version your servers are running. Then check your distribution's advisory page for CVE-2026-98432 and apply the fix as soon as it's available. If you can't patch immediately, restrict exposed services and review your firewall rules.
Second, think about your detection layer. A root-level remote exploit often leaves traces in process trees and outbound connections. If you're not logging that, you're flying blind.
And third — this one's for the privacy-minded folks running antidetect browsers and isolated profiles — remember that server-side vulnerabilities don't care how clean your browser fingerprint is. Your infrastructure security and your client-side privacy are two separate battles. Win both.
The 9.8 score is a warning shot. The AI-written exploit is the follow-through. Treat this one seriously, and treat your patch cadence like it actually matters — because now, more than ever, it does.
