A defect in the Linux kernel's TCP stack, catalogued as CVE-2026-98432 and scored 9.8 out of 10 by the kernel's own CVE team, reaches across Ubuntu, Red Hat Enterprise Linux and other distributions, The Hacker News reports. Compounding the rating, Anthropic said on 27 October that one of its AI models produced an exploit for the flaw — an exploit the company describes as enabling a remote, unauthenticated attacker to run commands as root on an affected server. That capability is Anthropic's own account of its model's output; it has not been independently verified here.
For operators running Ubuntu or RHEL fleets, triage comes first. The checklist below is this publication's summary of the patch-and-rollback sequence to work through — it is not vendor wording, and the distribution advisories remain the authoritative source for what to apply:
Patch and rollback checklist (Ubuntu / RHEL fleets) 1. Inventory: List every host running Linux, noting kernel version and distribution release. 2. Verify: Check the official Ubuntu and Red Hat security advisories to confirm whether CVE-2026-98432 appears in their affected scope and which fixed versions are offered. 3. Patch and reboot: Install the kernel update, then fully restart the host — kernel-level defects of this kind generally cannot be closed by live patching alone, and an unpatched reboot should be treated as still exposed. 4. Compress the rollout window: Shorten the path from testing to full deployment so the exposure period is as brief as operationally possible. 5. Snapshot before upgrading: Keep rollback-ready images or VM snapshots so a compatibility problem after the update can be reverted quickly. 6. Restrict network access in the interim: Until patching lands, use host firewalls or security groups to limit traffic to these machines to trusted sources as a stopgap mitigation.
Verification should follow a fixed order: confirm the CVE identifier first, cross-check the vendor advisories second, and consult Anthropic's first-hand disclosure third.
The second act of this story is what lifts it above a routine kernel advisory. The chain Anthropic describes is not a paper proof-of-concept — it converts a TCP-layer defect into unauthenticated root-level execution. Two facts sit behind that: the chain reportedly emerged from a large language model, and Anthropic publicised it within days of the flaw passing through the CVE process.
What follows for defenders is a compression of the familiar buffer between disclosure and exploitation. Defenders have long leaned on an informal lag before reliable attacks materialise; that slack narrows when an exploit can be requested from a model rather than assembled by hand. Nobody is reporting opportunistic scanning against CVE-2026-98432 yet — but with a flaw sitting in core TCP code that ships on vast numbers of servers rather than in an optional component, the pool of reachable targets is large by default, and scanners arriving quickly would be unsurprising.
A severity score alone rarely changes anyone's behaviour. A 9.8 paired with a publicly described path to root does. Organisations running Ubuntu or RHEL should treat the checklist above as a same-day action item, and treat Anthropic's disclosure as a signal that the economics of writing exploits have shifted.
Before any patching decision is filed, the distribution scope should be confirmed against The Hacker News' reporting, the fix against each vendor's advisory, and the exploit claims against Anthropic's 27 October statement.
據 The Hacker News 報道，Linux 內核 TCP 協定堆疊中的一項缺陷，編號為 CVE-2026-98432，並由內核自身的 CVE 團隊評出 10 分滿分中的 9.8 分，影響範圍遍及 Ubuntu、Red Hat Enterprise Linux 及其他發行版。使評分更形嚴重的是，Anthropic 於 10 月 27 日表示，旗下其中一個 AI 模型已為該漏洞生成了漏洞利用程式（exploit）——該公司形容，這款 exploit 可讓遠端未經身份驗證的攻擊者在受影響的伺服器上以 root 身份執行指令。此一能力係 Anthropic 對其模型輸出的自行描述，本文未經獨立核實。
對於管理 Ubuntu 或 RHEL 機群的系統管理員而言，優先事務是進行分級處理（triage）。以下清單是本刊對補丁及回滾流程的摘要——並非廠商原文措辭，各發行版的安全公告（advisory）仍是應採取何種行動的權威依據：
補丁及回滾清單（Ubuntu / RHEL 機群） 1. 盤點：列出所有運行 Linux 的主機，記錄內核版本及發行版版本號。 2. 核實：查閱 Ubuntu 及 Red Hat 官方安全公告，確認 CVE-2026-98432 是否在受影響範圍之內，以及提供哪些已修復版本。 3. 安裝補丁並重啟：安裝內核更新後，完整重啟主機——此類內核層級缺陷一般無法僅靠即時修補（live patching）關閉，未裝補丁便重啟的主機應視作仍處於暴露狀態。 4. 壓縮部署時間窗：縮短由測試到全面部署的流程，使暴露期盡可能縮短至維運上可接受的最短時間。 5. 升級前建立快照：保留可隨時回滾的映像或 VM 快照，以便更新後出現相容性問題時能迅速還原。 6. 過渡期間限制網絡存取：在補丁部署完成之前，利用主機防火牆或安全群組，將這些機器的流量限制為僅接受可信來源，作為臨時緩解措施。
核實工作應按固定次序進行：先確認 CVE 編號，其二交叉核對廠商公告，其三查閱 Anthropic 的第一手披露。
使這則消息有別於一般內核公告的，是故事的第二幕。Anthropic 所描述的攻擊鏈並非紙面概念驗證（proof-of-concept）——它把 TCP 層的缺陷轉化為未經身份驗證的 root 級別執行能力。背後有兩項事實：據報該攻擊鏈出自一個大型語言模型（large language model），以及 Anthropic 在漏洞通過 CVE 流程後數日內即將其公開。
對防禦方而言，後果是披露與利用之間那段向來存在的緩衝期遭到壓縮。防禦者一向依賴可靠攻擊出現前的非正式滯後期；但當 exploit 可以向模型索取，而非親手組裝時，這段寬限便會收窄。目前尚無人報告針對 CVE-2026-98432 的 opportunistic 掃描——然而此漏洞位於隨海量伺服器出貨的核心 TCP 程式碼之中，而非選裝元件，預設可觸及的目標池本已龐大，掃描器迅速到來並不令人意外。
單一個嚴重性評分很少會改變任何人的行為。但 9.8 分配上一條公開描述的 root 提權路徑就會了。運行 Ubuntu 或 RHEL 的機構應把上述清單視為當日行動項目，並把 Anthropic 的披露視為一個信號：編寫 exploit 的成本結構已經改變。
在作出任何補丁決定之前，應先對照 The Hacker News 的報道確認受影響的發行版範圍，對照各廠商公告確認修復內容，並對照 Anthropic 10 月 27 日的聲明核實有關 exploit 的說法。