CVE-2026-98432 is a critical Linux kernel use-after-free in IPv4 TCP connection handling, rated CVSS 9.8 by the kernel’s CNA. It affects unpatched kernels dating back to Linux 4.4 and is reachable remotely without authentication, before a connection reaches an application. During the handshake, the kernel transfers saved IPv4 option data from a temporary request socket to a full socket without copying it, then may free the memory while another CPU is still using it. The resulting race can expose kernel memory, corrupt it, or crash the system. Anthropic reported that its Claude model produced a working exploit capable of obtaining root access on servers with a multipath TCP listener; the exploit has not been published. IPv6 is not affected by the main issue.
The upstream repair replaces immediate frees with RCU-delayed frees, allowing active readers to finish, and also addresses request-socket migration. Fixed kernels include 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3; distribution kernels may backport the repair under different version numbers. As of October 29, 2026, Debian, certain SUSE and Oracle kernels, and Amazon Linux 2023’s kernel 6.12 and 6.18 had fixes, while Ubuntu, RHEL 8-10, Amazon Linux 2, and Amazon Linux 2023’s default kernel did not. Administrators should check their distribution’s advisory, install its fixed kernel, and reboot hosts, including container and Kubernetes nodes. Where patching is delayed, the recommended interim step is to drop TCP packets carrying IPv4 options and prioritize systems with MPTCP listeners.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Colin Percival discovered that Intel Hyper-Threading could leak cryptographic secrets and developed an exploit to recover an RSA key. He argues scholars who find security flaws should coordinate quietly with affected teams so patches are ready before public disclosure. (daemonology.net)
Binance says it has covered 90% of the $6.3 billion in cryptocurrency stolen in a hack and will absorb the losses rather than pass them to users. It has set aside more than $6.34 billion and says sourcing the remaining assets may take longer. (bbc.com)
Plymouth canceled its Flock license-plate camera contract after the system wrongly tracked a couple, but the company did not respond to removal requests. The police chief disconnected the cameras’ power to ensure they stopped recording vehicles. (thedrive.com)
A hacking group said it exploited a vulnerability in software used to manage LED advertising screens, displaying pornographic footage on a highway billboard in Egypt and accessing screens in several other countries. Egyptian authorities opened an investigation and suspended roadside displays, while the incident raised questions about security at the billboard operator. (cairoreport.org)
VOLTA infostealer steals credentials, financial data, and personal details, then sends an evidence bundle to an LLM to rank victims by potential value. If a model refuses, the malware tries a chain of other models, making AI a key part of its intelligence-gathering workflow. (blog.talosintelligence.com)
Cybersecurity startup Cathedral accessed Anthropic’s internal systems in under 12 hours during an authorized security test, exposing employee details, salary information, job offers and internal messages. Its AI agents found weaknesses in business software and accessed meeting transcripts and Slack conversations. (indiatoday.in)
Today's best Hacker News stories, summarized and screenshotted, one email a day.