Anthropic disclosed a zero-click exploit for CVE-2026-98432, a race-condition-induced use-after-free bug in the Linux kernel that can give an unauthenticated attacker remote root access on servers running Multipath TCP (MPTCP). The flaw lies in how the kernel handles IP options during IPv4 TCP connection establishment, allowing a use-after-free condition when a child socket is freed while another CPU accesses the same options. The upstream fix defers object release until after a read-copy-update (RCU) grace period. The vulnerability received a critical severity score of 9.8 and affects eight kernel branches dating back to version 4.4, with fixed releases including 5.10.272, 5.15.223, 6.6.159, 6.1.190, 6.12.113, 6.18.56, 7.2.10 and 7.3-rc7. Ubuntu and Red Hat Enterprise Linux had not yet released patches as of October 30, while Debian, Oracle Linux, SUSE and Amazon Linux offered some fixed packages. 1