Posted on

2026-11-01 — Linux Kernel CVE-2026-98432: IPv4 TCP Use-After-Free and Remote Root Exploit: Sentinel Hunts

Threat Overview

CVE-2026-98432 is a use-after-free race in the Linux kernel IPv4 TCP handshake. A retransmitted connection request or socket migration can cause freed IP-option memory to be accessed concurrently. Anthropic reported on October 27, 2026 that a research model produced a working laboratory exploit against a Linux server with a Multipath TCP (MPTCP) listener: it remotely leaked kernel memory and executed a shell command as root without authentication. Red Hat issued a Critical bulletin on October 30, emphasizing that the vulnerable code path is reachable through ordinary IPv4 TCP traffic. A working remote-root exploit against a non-MPTCP listener has not been publicly demonstrated; this does not establish that regular TCP listeners are safe.

References

Impacted Systems

Linux kernel IPv4 TCP networking, not a Node.js or HTTP application defect. Vulnerable code dates to Linux 4.4. Red Hat identifies RHEL 8, 9, 10 and OpenShift Container Platform (including RHEL-derived kernel environments). Deployment: bare-metal servers, virtual machines, container hosts, Kubernetes nodes and Linux-based appliances. Prerequisite: reachable IPv4 TCP listener; MPTCP listener is the demonstrated laboratory RCE configuration. No authentication required. Upstream fixed versions by branch: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3. Distribution kernels may carry backports under different version numbers. Red Hat’s October 30 bulletin stated fixes were being expedited. The primary issue is IPv4, not generic IPv6.

Why this matters

A remotely reachable kernel bug with laboratory-proven root execution presents broad Linux infrastructure risk. It operates below application logging, and failed races may not crash the host. Sentinel hunting therefore focuses on weak network/crash clues and higher-signal post-compromise behavior, rather than pretending to identify exploit packets from ordinary firewall logs.

Exploitation Status

Confirmed CVE and researcher-demonstrated laboratory remote-root execution on MPTCP listeners. Red Hat acknowledges potential unauthenticated RCE. No verified exploitation in the wild was established in the cited sources as of November 1, 2026. Anthropic did not publish the exploit.

What this hunt looks for

Prepared conditional hunts using Syslog, CommonSecurityLog and Defender for Endpoint for kernel faults, inbound TCP anomalies, privileged shells, outbound shell traffic, systemd/cron changes and Linux audit command events. No customer workspace was queried.

Required logs

  • L01 — Linux kernel UAF and crash messages: Syslog
  • L02 — Repeated inbound TCP connections to one target: CommonSecurityLog
  • L03 — Linux service unexpectedly spawning a shell: DeviceProcessEvents
  • L04 — Root shell establishing public outbound connections: DeviceProcessEvents, DeviceNetworkEvents
  • L05 — Linux systemd and cron persistence changes: DeviceFileEvents
  • L06 — Privileged command execution in Linux audit Syslog: Syslog
  • L07 — Root commands indicating staging or persistence: DeviceProcessEvents

L01 — Linux kernel UAF and crash messages

Syslog
| where TimeGenerated >= ago(14d)
| where SyslogMessage has_any ('use-after-free','BUG:','kernel panic','general protection fault','KASAN','slab-out-of-bounds','RIP:','Oops:')
| project TimeGenerated, HostName, ProcessName, Facility, SyslogMessage
| order by TimeGenerated desc

L02 — Repeated inbound TCP connections to one target

CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where Protocol has 'TCP'
| where isnotempty(SourceIP) and isnotempty(DestinationIP)
| summarize Events=count(), Ports=dcount(DestinationPort), Actions=make_set(DeviceAction,10) by SourceIP, DestinationIP, bin(TimeGenerated, 10m)
| where Events >= 300 and Ports <= 5
| order by Events desc

L03 — Linux service unexpectedly spawning a shell

DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where FileName in~ ('sh','bash','dash','zsh','python','python3','perl','busybox')
| where InitiatingProcessFileName in~ ('nginx','apache2','httpd','node','java','gunicorn','uvicorn','php-fpm','python3')
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessId
| order by TimeGenerated desc

L04 — Root shell establishing public outbound connections

let shells = DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where AccountName =~ 'root' and FileName in~ ('sh','bash','dash','zsh','nc','ncat','socat','python3')
| project DeviceId, DeviceName, ProcessId, ShellTime=TimeGenerated, Shell=FileName, ProcessCommandLine;
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where isnotempty(RemoteIP) and ipv4_is_private(RemoteIP) == false
| join kind=inner shells on DeviceId
| where InitiatingProcessId == ProcessId and TimeGenerated between (ShellTime..ShellTime+2h)
| project TimeGenerated, DeviceName, ShellTime, Shell, ProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated desc

L05 — Linux systemd and cron persistence changes

DeviceFileEvents
| where TimeGenerated >= ago(14d)
| where FolderPath has_any ('/etc/systemd/system/','/etc/cron.d/','/etc/cron.daily/','/var/spool/cron/')
| where ActionType in ('FileCreated','FileModified','FileRenamed')
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

L06 — Privileged command execution in Linux audit Syslog

Syslog
| where TimeGenerated >= ago(14d)
| where SyslogMessage has 'type=EXECVE' or SyslogMessage has 'COMMAND='
| where SyslogMessage has_any ('bash','/bin/sh','curl','wget','nc ','socat','chmod','systemctl')
| project TimeGenerated, HostName, ProcessName, SyslogMessage
| order by TimeGenerated desc

L07 — Root commands indicating staging or persistence

DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where AccountName =~ 'root'
| where ProcessCommandLine has_any ('/dev/shm/','/tmp/.','curl ','wget ','base64 -d','chmod +x','nohup ','/etc/cron.d/')
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

Detection Notes

Highest signal for post-compromise triage: L04 correlated with unusual privileged process creation, L03 and L05. L01 requires kernel faults forwarded to Syslog, but failed exploit races can be silent. L02 is a broad TCP-volume anomaly, not a specific SYN-retransmission or IPv4-options detector; legitimate scans and busy services generate noise. L06 needs Linux audit/sudo details forwarded into Syslog. Kernel-root execution can bypass conventional service-child ancestry. No ordinary Sentinel log source can conclusively establish that the race was exploited; raw packet capture or kernel-specific instrumentation would be required.

Leave a Reply