Most security bugs we write about need something from you first: a malicious extension you installed, a key you pasted into a dashboard, a library you forgot to update. This one needs nothing. CVE-2026-98432 is a race condition in the Linux kernel's IPv4 TCP code, and the only requirement for reaching the vulnerable path is that your server accepts TCP connections.

The bug was fixed upstream weeks ago. It became urgent this week, because three things landed on top of each other: Anthropic published a working remote root exploit, the Go team warned that Go services quietly opt into the exact feature that exploit uses, and Red Hat issued a Critical bulletin while several distributions still had no patched kernel to install.

This post sticks to what the kernel CVE team, Anthropic, the Go security team, Red Hat, Ubuntu, CIQ and Akamai/Linode have published.…