CVE-2026-98432 affects unpatched Linux kernels from version 4.4 onward, allowing IPv4 TCP connection handling to access freed memory. The kernel CNA and Red Hat rate it CVSS 9.8; unauthenticated remote attacks can cause information disclosure, crashes or code execution. Anthropic’s demonstrated remote-root exploit used a configuration with an MPTCP listener. Fixes have reached stable kernels, but distribution availability varies, so operators should compare their running kernel with vendor advisories, update and reboot. Container hosts also need attention. Red Hat says filtering IPv4 packets with IP options reduces exposure but is not a complete remedy.