Linux yadrosining TCP kodidagi kamchilik, CVE-2026-98432 sifatida kuzatilgan, Ubuntu, Red Hat Enterprise Linux (RHEL) va boshqa Linux tarqatishlariga ta'sir qiladi. Yadro o'zining CVE jamoasi uni CVSS shkalasi bo'yicha 10 dan 9.8 ball bilan baholaydi.
Anthropic 27-oktabrda aytishicha, uning AI modeli ushbu kamchilikdan foydalanadigan eksploit yozgan, bu esa masofaviy hujumchiga hech qanday ma'lumotlarsiz Linux serverlarida root sifatida buyruqlarni bajarishga imkon beradi, agar serverda multipath TCP tinglovchisi bo'lsa.
29-oktabr holatiga ko'ra, Ubuntu va RHEL tuzatilgan yadroni chiqarishmagan. Red Hat, Amazon, Oracle va SUSE kamchilikni 5.9 dan 8.1 gacha, yadro jamoasining 9.8 dan pastroq baholaydi.
Kamchilik — bu yangi IPv4 TCP ulanishlarini o'rnatadigan koddagi poyga sharti (race condition). Bu yadroga allaqachon ozod qilingan xotirani o'qishiga sabab bo'lishi mumkin, bu esa use-after-free deb ataladigan xato turidir.
Yadro tuzatishi Anthropic tadqiqotchisi Xinyang Ge ni xatoni xabar qilgan deb e'tirof etadi. Na CVE yozuvi, na tuzatish multipath TCP (MPTCP) ni eslatadi. Ushbu xususiyat va bu xato o'rtasidagi bog'liqlik Anthropic postidan kelib chiqadi.
MPTCP bitta ulanishga bir vaqtda bir nechta tarmoq yo'llaridan foydalanish imkonini beradi. Linuxda ilova soket ochishda MPTCP ni so'rashi kerak.
Anthropic postida aytilishicha, kamchilik "yuqori oqimda tuzatilgan va barcha qo'llab-quvvatlanadigan barqaror yadro tarmoqlariga orqaga ko'chirilgan." Tarqatish foydalanuvchilari uchun bu tuzatish faqat sotuvchining yadro paketida keladi. Debian, Oracle Linux, SUSE va Amazon Linux kamida ba'zi yadrolari uchun tuzatilgan paketlarni chiqarishgan, lekin Ubuntu va RHEL hali ham emas.
Qaysi Tarqatishlarda Tuzatish Bor
| Tarqatish | Sotuvchi bahosi | 29-oktabr holati | Tuzatilgan paket yoki maslahat |
|---|---|---|---|
| Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS va 26.10 | Yuqori ustuvorlik | Ish jarayonida | Hech biri chiqarilmagan |
| Ubuntu 16.04, 18.04 va 20.04 | Yuqori ustuvorlik | Zaif | Hech biri chiqarilmagan |
| RHEL 8, 9 va 10, OpenShift 4 | O'rtacha, 5.9 (CVE sahifasi) Muhim, 8.1 (maslahat fayli) | Tuzatish kechiktirilgan | Hech biri chiqarilmagan |
| RHEL 7 | Qo'llanilmaydi | Ta'sirlanmagan | Kerak emas |
| Amazon Linux 2023, kernel6.18 paketi | Muhim, 7.0 | 24-oktabrda tuzatilgan | kernel6.18-6.18.56-125.164.amzn2023 (ALAS2023-2026-3251) |
| Amazon Linux 2023, kernel6.12 paketi | Muhim, 7.0 | 29-oktabrda Amazon maslahatida tuzatilgan; Amazon CVE sahifasi hali ham kutish holatida | kernel6.12-6.12.113-138.209.amzn2023 (ALAS2023-2026-3335) |
| Amazon Linux 2 Amazon Linux 2023, yadro paketi | Muhim, 7.0 | Tuzatish kutish holatida | Hech biri chiqarilmagan |
| Oracle Linux 7, 8, 9 va 10, UEK yadrosi | Muhim, 8.1 | 16-oktabrda tuzatilgan | ELSA-2026-500397, ELSA-2026-500398, ELSA-2026-500399 |
| Debian trixie (barqaror) | Ball ro'yxati yo'q | 16-oktabrda tuzatilgan | linux 6.12.113-1 (DSA-6568-1) |
| Debian 12 (bookworm) | Ball ro'yxati yo'q | 17-oktabr va 22-oktabrda tuzatilgan | linux 6.1.190-1 (DLA-4841-1) linux-6.12 6.12.113-1~deb12u1 (DLA-4850-1) |
| SUSE Linux Micro 6.2, openSUSE Leap 16.0 | Muhim, 8.1 | Tuzatilgan | kernel-default 6.12.0-160000.40.1 yoki undan yuqori |
| SLES 15 SP4 dan SP6 LTSS, SLES 16.0, SLE Micro 5.3 dan 5.5 | Muhim, 8.1 | Sinovda | Hech biri chiqarilmagan |
| SLES 15 SP7 | Muhim, 8.1 | Ta'sirlangan, tuzatish jarayonida | Hech biri chiqarilmagan |
Ubuntu shuningdek o'zining bulut, FIPS va real-vaqt yadrolarini zaif yoki ish jarayonida deb ro'yxatga olgan. Red Hat o'z tuzatishlari "hozirda kelajakdagi yangilanishga kechiktirilgan" deb aytadi. Na Red Hat, na Ubuntu chiqarish sanasini bermaydi.
Xato Qanday Ishlaydi
Poyga TCP qo'l siqish (handshake) jarayonida sodir bo'ladi. Ulanish tugallanganda, yadro kutib turgan so'rov bilan saqlangan IP variantlarini yangi soketga nusxalamasdan topshiradi.
Agar bu soket boshqa CPU hali ham variantlardan foydalanib qayta yuborilgan ulanish so'roviga javob berayotganda yo'q qilinsa, yadro ozod qilingan xotirani o'qiydi.
IPv6 bu poygadan ta'sirlanmaydi, chunki yadro IPv6 ulanishlari uchun variantlarni nusxalaydi.
Xato Linux 4.4 da kiritilgan. Yadro ishlab chiquvchilari tuzatishni 5-oktabrda, CVE e'lon qilinganidan o'n kun oldin qo'llagan.
Tuzatish yadroga boshqa CPU lar variantlarni o'qishni tugatguncha kutishni talab qiladi, shundan so'ng ularni ozod qiladi.
Nima Uchun Ballar Farq Qiladi
Yadro CVE jamoasi CVE yozuviga 9.8 ballni 24-oktabrda, CVE e'lon qilinganidan to'qqiz kun keyin qo'shgan.
Uning balli hujumchini IPv4 Record Route yoki Timestamp variantlarini o'z ichiga olgan TCP ulanish so'rovini yuborib, so'ngra poygani yutish uchun so'rovni qayta yuboradigan hujumchini nazarda tutadi. Jamoa hujum murakkabligini past deb baholagan, poyganing ikkala tomoni ham "hujumchi tomonidan keltirilgan" deb aytgan.
Bunday holatda, jamoa aytishicha, xato yaqin yadro xotirasini hujumchiga qaytarishi, yadro xotirasini buzishi yoki tizimni ishdan chiqarishi mumkin.
28-oktabr holatiga ko'ra, Milliy Zaiflik Ma'lumotlar Bazasi (NVD) o'z ballini qo'shmagan va yadro jamoasining 9.8 ballini ko'rsatgan. Ubuntu sahifasi ham shu ballni ko'rsatadi.
Red Hat CVE sahifasi kamchilikni O'rtacha deb baholaydi va 5.9 ball beradi, chunki poygani yutish qiyin. U eng ehtimol natija yadro ishdan chiqishi, nazariy jihatdan xotira buzilishi mumkinligi, va "hech qanday maxfiylik yoki yaxlitlik ta'siri ko'rsatilmagan" deb aytadi.
Red Hatning mashinada o'qiladigan maslahat fayli, 29-oktabrda yangilangan, ta'sirni Muhim deb ro'yxatga oladi va kamchilikni 8.1 ball bilan baholaydi, yuqori maxfiylik va yaxlitlik ta'siri bilan. Red Hat xato kuzatuvchisi o'sha kuni masalaning jiddiyligini o'rtachadan yuqoriga o'zgartirgan. O'sha kuni CVE sahifasi O'rtacha va 5.9 ni ko'rsatgan.
Oracle va SUSE ham kamchilikni 8.1 ball bilan baholaydi, Red Hat maslahat fayli bilan bir xil CVSS vektori bilan. Bu ballar yadro jamoasi bilan har bir metrikada mos keladi, faqat hujum murakkabligi bundan mustasno, sotuvchilar uni yuqori, yadro jamoasi esa past deb baholaydi. Amazon uni 7.0 ball bilan baholaydi.
Anthropic Nima Qurganini Aytadi
Anthropic Linux eksploitini 27-oktabr postida, o'zining AI modeli Claude topgan va eksploit qilgan kamchiliklar haqida tasvirlagan. The Hacker News postni 28-oktabrda yoritgan. Anthropic aytishicha, Claude eksploitni "dastlabki so'rovdan so'ng" yozgan.
Eksploit ikki bosqichda ishlaydi. Birinchidan, poyga yadroga hujumchiga qo'shimcha baytlarni qaytarishiga sabab bo'ladi. Ushbu javoblardan biri yadro manzilini o'z ichiga olganda, hujumchi KASLR, yadro xotira manzili tasodifiylashtirishini chetlab o'tishi mumkin.
Ikkinchidan, xuddi shu xato buferni to'ldiradi va qayta chaqirish ko'rsatkichini (callback pointer) hujumchi allaqachon yadro xotirasiga joylashtirgan yuklama manzili bilan almashtiradi. Yadro bu ko'rsatkichni chaqirganda, yuklama hujumchining tanlagan shell buyrug'ini root sifatida bajaradi.
Yutqazilgan poyga faqat o'sha bitta ulanish urinishini muvaffaqiyatsiz qiladi va tizimni ishdan chiqarmaydi, shuning uchun hujumchi qayta-qayta urinishni davom ettirishi mumkin, deb aytgan kompaniya. Uning sinovida yadro manzilini sizdirish 48 daqiqa, buyruq bajarilishiga erishish esa yana 5 daqiqa olgan.
Post eksploit kodini, yadro versiyasini yoki Anthropic sinov qilgan konfiguratsiyani o'z ichiga olmaydi.
Red Hat aytishicha, ochiq TCP xizmatiga yetib boradigan masofaviy hujumchi poygani keltirib chiqarishi mumkin. Biroq Anthropicning root eksploitiga multipath TCP tinglovchisi bo'lgan serverlar maqsad qilingan. Post bunday tinglovchisi bo'lmagan serverlar ham xuddi shu tarzda egallanishi mumkinmi, deb aytmaydi.
29-oktabr holatiga ko'ra, sotuvchi maslahatlarining hech biri, CVE yozuvi yoki Anthropic posti kamchilikdan foydalanib hujum qilinganini xabar qilmaydi. U Lyuksemburgning CIRCL 28-oktabrda oxirgi yangilagan CISA Ma'lum Ekspluatatsiya Qilingan Zaifliklar katalogining nusxasida ko'rinmaydi.
Hozir Nima Qilish Kerak
Tarqatishingiz tuzatilgan yadroni chiqargan bo'lsa, uni o'rnating. Yuqoridagi jadval Debian, Oracle Linux, SUSE va Amazon Linux uchun paketlar va maslahatlarni ro'yxatga oladi.
Agar o'z yadroningizni quradigan bo'lsangiz, tuzatish Linux 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 va 7.3 da mavjud. Yadro CVE jamoasi eng so'nggi barqaror yadroga yangilanishni tavsiya qiladi. U yadro hamjamiyati alohida tuzatishlarni tanlab olishni qo'llab-quvvatlamasligini aytadi.
Ubuntu, RHEL va ba'zi Amazon Linux va SUSE nashrlari hali o'rnatish uchun tuzatilgan yadroga ega emas. Red Hat aytishicha, mavjud hech qanday yumshatish (mitigation) uning oson joylashtiriladigan, ko'pchilik o'rnatishlar uchun mos va barqaror bo'lish standartlariga javob bermaydi. Boshqa sotuvchi maslahatlarining hech biri bunday yumshatishni ro'yxatga olmaydi.
Maslahatlar va Anthropic posti multipath TCP ni o'chirish yoki IP variantlarini o'z ichiga olgan kiruvchi ulanish so'rovlarini bloklash xavfni kamaytiradimi, deb aytmaydi.
A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL), and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS scale.
Anthropic said on October 27 that its AI model wrote an exploit that uses the flaw to let a remote attacker with no credentials run commands as root on Linux servers with a multipath TCP listener.
As of October 29, Ubuntu and RHEL have not released a fixed kernel. Red Hat, Amazon, Oracle, and SUSE score the flaw between 5.9 and 8.1, lower than the kernel team's 9.8.
The flaw is a race condition in the code that sets up new IPv4 TCP connections. It can make the kernel read memory it has already freed, a bug type known as a use-after-free.
The kernel fix credits Anthropic researcher Xinyang Ge with reporting the bug. Neither the CVE record nor the fix mentions multipath TCP (MPTCP). The link between that feature and this bug comes from Anthropic's post.
MPTCP lets one connection use several network paths at once. On Linux, an application must request MPTCP when it opens a socket.
Anthropic's post says the flaw "was patched upstream and backported to all maintained stable kernel branches." For distribution users, that fix arrives only in the vendor's kernel package. Debian, Oracle Linux, SUSE, and Amazon Linux have shipped fixed packages, at least for some of their kernels, but Ubuntu and RHEL have not.
Which Distributions Have a Fix
| Distribution | Vendor rating | Status as of October 29 | Fixed package or advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 | Priority High | Work in progress | None released |
| Ubuntu 16.04, 18.04 and 20.04 | Priority High | Vulnerable | None released |
| RHEL 8, 9 and 10, OpenShift 4 | Moderate, 5.9 (CVE page) Important, 8.1 ( advisory file) | Fix deferred | None released |
| RHEL 7 | Not applicable | Not affected | Not needed |
| Amazon Linux 2023, kernel6.18 package | Important, 7.0 | Fixed October 24 | kernel6.18-6.18.56-125.164.amzn2023 (ALAS2023-2026-3251) |
| Amazon Linux 2023, kernel6.12 package | Important, 7.0 | Fixed October 29 in Amazon's advisory; Amazon's CVE page still says pending | kernel6.12-6.12.113-138.209.amzn2023 (ALAS2023-2026-3335) |
| Amazon Linux 2 Amazon Linux 2023, kernel package | Important, 7.0 | Pending fix | None released |
| Oracle Linux 7, 8, 9 and 10, UEK kernel | Important, 8.1 | Fixed October 16 | ELSA-2026-500397, ELSA-2026-500398, ELSA-2026-500399 |
| Debian trixie (stable) | No score listed | Fixed October 16 | linux 6.12.113-1 (DSA-6568-1) |
| Debian 12 (bookworm) | No score listed | Fixed October 17 and October 22 | linux 6.1.190-1 (DLA-4841-1) linux-6.12 6.12.113-1~deb12u1 (DLA-4850-1) |
| SUSE Linux Micro 6.2, openSUSE Leap 16.0 | Important, 8.1 | Fixed | kernel-default 6.12.0-160000.40.1 or later |
| SLES 15 SP4 to SP6 LTSS, SLES 16.0, SLE Micro 5.3 to 5.5 | Important, 8.1 | In testing | None released |
| SLES 15 SP7 | Important, 8.1 | Affected, fix in progress | None released |
Ubuntu also lists its cloud, FIPS, and real-time kernels as vulnerable or as work in progress. Red Hat says its fixes are "currently deferred to a future update." Neither Red Hat nor Ubuntu gives a release date.
How the Bug Works
The race happens during the TCP handshake. When a connection is completed, the kernel hands the IP options stored with the pending request to the new socket without copying them.
If that socket is destroyed while another CPU is still using the options to answer a resent connection request, the kernel reads freed memory.
IPv6 is not affected by this race because the kernel copies the options for IPv6 connections.
The bug was introduced in Linux 4.4. Kernel developers applied a fix on October 5, ten days before the CVE was published.
The fix makes the kernel wait until other CPUs finish reading the options before it frees them.
Why the Scores Differ
The kernel's CVE team added the 9.8 score to the CVE record on October 24, nine days after publishing the CVE.
Its score assumes an attacker who sends a TCP connection request carrying IPv4 Record Route or Timestamp options, then resends the request to try to win the race. The team rated attack complexity low, saying both sides of the race are "attacker-induced."
In that case, the team says, the bug could send nearby kernel memory back to the attacker, corrupt kernel memory, or crash the system.
As of October 28, the National Vulnerability Database (NVD) had not added its own score and showed the kernel team's 9.8. Ubuntu's page also shows that score.
Red Hat's CVE page rates the flaw Moderate, scoring it 5.9 because the race is hard to win. It says the most likely result is a kernel crash, with memory corruption possible in theory, and that "no confidentiality or integrity impact has been demonstrated."
Red Hat's machine-readable advisory file, updated on October 29, lists the impact as Important and scores the flaw 8.1, with high confidentiality and integrity impact. Red Hat's bug tracker changed the issue's severity from medium to high the same day. On that day, the CVE page showed Moderate and 5.9.
Oracle and SUSE also score the flaw 8.1, with the same CVSS vector as Red Hat's advisory file. Those scores match the kernel team's on every metric except attack complexity, which the vendors rate high and the kernel team rates low. Amazon scores it 7.0.
What Anthropic Says It Built
Anthropic described the Linux exploit in an October 27 post about flaws that its AI model, Claude, found and exploited. The Hacker News covered the post on October 28. Claude wrote the exploit after "initial prompting," Anthropic said.
The exploit works in two stages. First, the race makes the kernel send extra bytes back to the attacker. Once one of those replies contains a kernel address, the attacker can get around KASLR, the kernel's memory address randomization.
Second, the same bug overflows a buffer and overwrites a callback pointer with the address of a payload the attacker had already placed in kernel memory. When the kernel calls that pointer, the payload executes a shell command of the attacker's choice as root.
A lost race only fails that one connection attempt and does not crash the system, so an attacker can keep trying, the company said. In its test, leaking a kernel address took 48 minutes, and reaching command execution took 5 more minutes.
The post does not include the exploit code, the kernel version, or the configuration Anthropic tested.
Red Hat says a remote attacker who can reach an exposed TCP service could trigger the race. Anthropic's root exploit, however, targeted servers with a multipath TCP listener. The post does not say whether servers without one can be taken over the same way.
As of October 29, none of the vendor advisories, the CVE record, or Anthropic's post reports attacks using the flaw. It does not appear in a copy of CISA's Known Exploited Vulnerabilities catalog that Luxembourg's CIRCL last updated on October 28.
What to Do Now
Where your distribution has released a fixed kernel, install it. The table above lists the packages and advisories for Debian, Oracle Linux, SUSE and Amazon Linux.
If you build your own kernel, the fix is in Linux 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. The kernel's CVE team recommends updating to the latest stable kernel. It says the kernel community does not support cherry-picking individual fixes.
Ubuntu, RHEL and some Amazon Linux and SUSE releases have no fixed kernel to install yet. Red Hat says no available mitigation meets its standards for being easy to deploy, suitable for most installations and stable. None of the other vendor advisories lists one.
The advisories and Anthropic's post do not say whether turning off multipath TCP, or blocking incoming connection requests that carry IP options, would lower the risk.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.