Cascadity Audio
← All streams

#linux-kernel

Everything tagged linux-kernel, across every stream.

0
MVMaker Views #canonical#cve-2026-98432#Hacker-News#kernel#linux#linux-kernel#patching#red-hat#ubuntu#vulnerability

A developer takes his Ubuntu servers offline because Ubuntu had not shipped a fix for a critical Linux TCP flaw

A short, angry post that sparked a big debate about what 'timely patches' means; the Atlas advisory lays out which distributions had fixes and when.

In a November 2 post, the developer behind chalmovsky.com writes that he took all his Ubuntu servers offline and is moving them to another distribution. His complaint: CVE-2026-98432, a critical (CVSS 9.8) remotely reachable use-after-free in the Linux kernel's TCP code, had been patched by Debian on October 16, and Anthropic says it built a working root exploit, yet more than two weeks later every supported Ubuntu release, LTS included, was listed as vulnerable. He contrasts this with Ubuntu's promise of "timely patches for critical vulnerabilities" and with volunteer-run distributions (Debian, Arch, Alpine) that had shipped the fix.

Atlas's advisory, updated November 5, says Red Hat shipped fixed kernels on November 1 and AlmaLinux on November 2, while Ubuntu had a fixed kernel only for 26.10 and its fixes for 22.04, 24.04 and 26.04 were still in testing. Ubuntu's CVE page rates the bug Critical and offers an interim packet-filtering mitigation.

Rabbit Holes 2
  • Long-term support

    After exploring W*F Ubuntu?, for what an LTS release is supposed to promise, read about Long-term support.

    Explains the product lifecycle policy under which a stable release, such as an Ubuntu LTS, is maintained for longer than the standard edition.

    Wikipedia · Wade · 5 min

    0
  • Multipath TCP

    After exploring Linux's October 2026 TCP Use-After-Free: CVE-2026-98432 — Atlas, the feature the root exploit relies on is explained in Multipath TCP.

    Multipath TCP is an IETF effort to let a single TCP connection use several network paths at once for more throughput and redundancy.

    Wikipedia · Wade · 5 min

    0
Generated by AI.
0
CCybersecurity #AI-security#anthropic#chrome#exploit#linux-kernel#safari#vulnerability

Anthropic says an unreleased model built five working exploit chains, including a root shell on Linux over the network

Anthropic's post walks through each chain; The Hacker News checks which claims vendors' own records confirm and which rest on Anthropic's word.

In a research post on October 27, Anthropic said an unreleased internal model, after initial prompting and with little human involvement, found vulnerabilities in Chrome, Safari, Android, Windows and Linux and chained them into working proof-of-concept exploits. One opens the Calculator on a Mac running stock Chrome seconds after a page loads; another turns off Safari's same-origin policy so a page can read data from other sites. Anthropic says it reported everything to vendors first, and that 62 Chrome bugs got CVEs and were fixed by Chrome 156.

The Hacker News notes that Google and Apple credit Anthropic and Claude for specific fixes, but how much each chain needed from people can't be checked, and the Windows bug's public record names no finder.

The Linux chain gives a remote attacker a root shell on servers running a multipath TCP listener. Anthropic ties it to CVE-2026-98432, a race condition in the kernel's IPv4 TCP code that the kernel's CVE team rates 9.8 of 10. As of October 29, Debian, Oracle, SUSE and Amazon Linux had shipped fixed kernels; Ubuntu and Red Hat had not, and Red Hat rated the flaw lower.

Cascadic Analysis 2
UndertowAutonomous cyber capability scales attackers enormously

What hidden risk could pull against this, even if the news is good?

Anthropic's own framing is the point: exploit chains like these once took specialist teams, and its model built them after initial prompting with little human involvement, on a platform that runs many scanning agents in parallel. This time the work went to vendors first under a 90-day disclosure policy, and 62 Chrome bugs were fixed. The same kind of capability is not limited to labs that disclose responsibly, which is why Anthropic tells everyone to scan their own code.

0
UndertowDelayed Consequence / False Success Problem

What hidden risk could pull against this, even if the news is good?

"Patched upstream" is not the same as "patched on your server." As of October 29, Debian, Oracle, SUSE and Amazon Linux had shipped fixed kernels for the 9.8-rated multipath TCP flaw, while Ubuntu and Red Hat had not, and Red Hat rated it lower. When AI finds bugs faster than distributions and admins can roll out fixes, the announcement can make a problem look solved weeks before the machines that matter are actually safe.

0
Rabbit Holes 2

Sign in to upvote

Your votes tell us which stories, analysis and rabbit holes are worth it. We'll bring you right back to this spot and count your vote.

Sign in Create an account