VulnHub

Real-time Cybersecurity News

Critical

Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions

The Hacker News
Actively Exploited
LinuxCVEExploitVulnerabilityRed HatCanonical

Overview

A serious flaw in the Linux kernel's TCP implementation, identified as CVE-2026-98432, has been discovered, impacting multiple Linux distributions including Ubuntu and Red Hat Enterprise Linux (RHEL). The vulnerability has been given a CVSS score of 9.8, indicating its severity. Researchers from Anthropic reported that they were able to create an exploit that allows remote attackers, without any credentials, to execute commands as the root user on affected servers. This poses a significant risk to the security of Linux systems, particularly in environments where these distributions are commonly used. Users and administrators need to be aware of this vulnerability and take appropriate action to protect their systems.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Ubuntu, Red Hat Enterprise Linux (RHEL), and potentially other Linux distributions using the affected kernel version.
  • Action Required: Users should update their Linux distributions to the latest kernel version that includes patches for CVE-2026-98432.
  • Timeline: Newly disclosed

Original Article Summary

A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale. Anthropic said on October 27 that its AI model wrote an exploit that uses the flaw to let a remote attacker with no credentials run commands as root on Linux servers with a

Impact

Ubuntu, Red Hat Enterprise Linux (RHEL), and potentially other Linux distributions using the affected kernel version.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should update their Linux distributions to the latest kernel version that includes patches for CVE-2026-98432. Specific patch numbers or versions were not provided, so checking with the respective distribution's security advisories is recommended.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Linux, CVE, Exploit, and 3 more.

Read Original Article

Related Coverage

Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen

The Hacker News

Binance, one of the largest cryptocurrency exchanges, announced on Thursday that it experienced a significant security breach affecting approximately $6.3 billion in assets. As a result of this incident, nearly $3 billion worth of assets have been frozen on the blockchain. Companies like Tether and Circle have also taken precautionary measures by freezing over $1.5 billion in USDT and $800 million related to the breach. This incident raises concerns about the security of digital assets and highlights the risks associated with cryptocurrency exchanges, as users may face challenges accessing their funds while the situation is being resolved. As investigations continue, users and investors are urged to stay informed about their assets and the potential implications of this breach.

Oct 30, 2026

Hugging Face malware campaign returns to hijack GPUs for crypto mining

BleepingComputer

A recent malware campaign has resurfaced, exploiting Hugging Face models to hijack GPU servers for cryptocurrency mining. Days after a previous takedown, attackers have planted backdoors in systems, with one model being downloaded more than 28,000 times. This poses a significant risk to organizations using these models, as their computing resources can be misappropriated for illicit mining activities. Additionally, researchers have identified a fake Solana starter kit on GitHub, which is designed to trick AI coding agents into installing a remote access Trojan (RAT) called NetSupport. This highlights the ongoing vulnerability in the AI and crypto spaces, where malicious actors are increasingly targeting users and infrastructure.

Oct 29, 2026

Polymarket halts trading after crypto-draining script breach, $2.5M traced

BleepingComputer

Polymarket, a prediction market platform, has paused trading after hackers exploited a vulnerability in a third-party service to deploy a malicious JavaScript script. This breach allowed the attackers to siphon off around $2.5 million in cryptocurrency. The stolen assets have been traced to a wallet believed to belong to the attackers. This incident raises concerns about the security of third-party services and the potential risks they pose to platforms relying on them. Users of Polymarket and similar services should remain vigilant about the security measures in place and how their data is protected.

Oct 29, 2026

Anthropic-Themed Phishing Emails Bypass Top Security Tools

darkreading

Recent reports indicate that phishing emails themed around the AI company Anthropic are managing to bypass some of the leading secure email gateway (SEG) products. These emails exhibit several obvious signs of phishing, yet they are still getting through security filters that are supposed to block such threats. This situation raises concerns about the effectiveness of current email security measures, as attackers continue to find ways to exploit vulnerabilities. Users and organizations must remain vigilant against these types of emails, as they can lead to serious security breaches. It underscores the need for improved security protocols and user education regarding phishing attempts.

Oct 29, 2026

ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories

The Hacker News

This week's cybersecurity updates highlight a mix of vulnerabilities and attacks that showcase both skillful tactics and careless oversights. Exposed passwords and outdated bugs are still being exploited, putting users at risk. Hackers are increasingly using trusted applications and AI tools to execute their schemes, blurring the lines of trust for unsuspecting users. In particular, banking trojans are being rented out, allowing less skilled attackers to launch sophisticated attacks. The situation underscores the need for vigilance in cybersecurity practices, as both individuals and organizations must remain aware of these evolving threats.

Oct 29, 2026

Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware

BleepingComputer

A new advanced persistent threat group, identified as UAT-11473, has been exploiting a serious authentication-bypass vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controllers. This flaw allows attackers to bypass authentication mechanisms and deploy a custom malware framework known as KeyDrift. Organizations using Cisco's SD-WAN technology may be at risk, as this could lead to unauthorized access and potential data breaches. The situation is concerning because it highlights the vulnerabilities in widely used network management systems and the increasing sophistication of cyber threats. Companies should prioritize patching their systems to mitigate this risk and protect sensitive information.

Oct 29, 2026