Inferlume

How it Works

Reports

Pricing

About

Get Free Access →

Get Free Access

Last Updated On

Friday, October 30, 2026

FFLLAASSHH__2200226611003300

CCrriittiiccaall

PPrrooooff--ooff--CCoonncceepptt AAvvaaiillaabbllee

Linux Kernel IPv4 TCP Handshake Race Condition Enables Remote Root Execution

A critical race condition and use after free vulnerability tracked as CVE-2026-98432 resides in the Linux kernel IPv4 TCP connection establishment subsystem. When accepting an incoming IPv4 TCP handshake containing IPv4 header options, the kernel transfers ownership of option memory to the child socket without copying it or enforcing Read Copy Update grace periods upon destruction. Concurrent processing of a retransmitted TCP SYN packet on a separate processor core reads freed memory inside ip_options_build, enabling kernel memory disclosure and function pointer overwrite. Researchers at Anthropic demonstrated an unauthenticated remote root exploit against Linux servers operating Multipath TCP listeners, defeating Kernel Address Space Layout Randomization in 48 minutes and achieving root shell command execution 5 minutes later. While upstream stable Linux kernels, Debian GNU/Linux, SUSE Linux Enterprise Server, Oracle Linux, and Amazon Linux 2023 have shipped fixed kernel packages, Canonical Ubuntu Server and Red Hat Enterprise Linux remain unpatched as of October 30, 2026. Because the Go programming language enables Multipath TCP by default on Linux listening sockets starting in Go 1.24, enterprise cloud workloads and container hosts face widespread exposure requiring immediate nftables packet filtering and Multipath TCP hardening. #CyberSecurity #LinuxKernel #ThreatIntelligence #SecOps #DetectionEngineering #CloudSecurity #Golang #InfoSec

9.8

CVSS Score

IOC Count

Source Count

Confidence Score

CVEs

CVE-2026-98432

Actors

Unattributed

Sectors

Cloud Computing, Information Technology, Financial Services, Telecommunications, Government, Healthcare, Critical Infrastructure

Regions

Global, North America, Europe, Asia Pacific, India

Chapter 01 - Executive Overview

A critical memory corruption flaw identified as CVE-2026-98432 impacts the Linux kernel IPv4 Transmission Control Protocol (TCP) stack across versions 4.4 through 7.2. Disclosed on October 15, 2026, and scored at CVSS 9.8 by the Linux kernel CVE assignment team, the defect allows unauthenticated remote attackers to trigger a use after free condition during standard TCP three way handshakes without user interaction or prior credentials.

[+] Unauthenticated Remote Root Demonstration: On October 27, 2026, Anthropic security researcher Xinyang Ge disclosed that an internal Claude model identified CVE-2026-98432 and constructed a working remote root exploit against a Linux host exposing a Multipath TCP (MPTCP) listener. Because losing the multi core timing race merely aborts the individual TCP handshake without inducing a kernel panic, an attacker can repeat handshake attempts continuously over the network until winning the race window.

[+] Two Stage KASLR Bypass And Control Flow Hijack: The demonstrated exploit operates across two distinct phases over roughly 53 minutes of sustained network probing. During the first 48 minutes, repeated race triggers corrupt length validation in IPv4 option construction to leak kernel heap pointers back to the client in TCP SYNACK replies, defeating Kernel Address Space Layout Randomization (KASLR). During the final 5 minutes, the exploit reuses the use after free primitive to overwrite a kernel callback pointer and execute arbitrary commands as root in Ring 0.

[+] Hidden Multipath TCP Attack Surface In Go Workloads: Although the underlying vulnerability resides in general IPv4 TCP option handling rather than Multipath TCP code specifically, the confirmed remote code execution proof of concept relies on an active MPTCP listener. Starting with Go 1.24, the Go standard library automatically requests MPTCP on all Linux listening sockets whenever the host kernel sets net.mptcp.enabled to 1, which is the default state on Canonical Ubuntu 24.04 LTS and 26.04 LTS.

[+] Enterprise Distribution Patch Gap On Ubuntu And RHEL: While upstream Linux kernel maintainers merged the fix in commit e3f33b0a1d89d738e2b913dab519226eaf76e15b and backported it across stable branches alongside Debian GNU/Linux, SUSE Linux Enterprise Server, Oracle Linux, and Amazon Linux 2023, Canonical Ubuntu Server (16.04 LTS through 26.10) and Red Hat Enterprise Linux (versions 8, 9, and 10) lack released production patches as of October 30, 2026.

Chapter 02 - Threat & Exposure Analysis

The technical root cause of CVE-2026-98432 stems from lockless request socket processing introduced in Linux 4.4 combined with immediate memory deallocation of shared IPv4 options structures without waiting for concurrent Read Copy Update (RCU) readers to complete.

[+] Lockless Request Socket Transfer In tcp_v4_syn_recv_sock: When a Linux listening socket receives an initial IPv4 TCP SYN packet containing IPv4 header options (such as Record Route or Timestamp), the kernel stores the parsed struct ip_options_rcu pointer inside ireq->ireq_opt on the half open request socket. Upon completion of the handshake inside tcp_v4_syn_recv_sock(), the kernel transfers ownership of ireq->ireq_opt directly to the newly allocated child socket pointer newinet->inet_opt without duplicating the memory block.

[+] Premature Deallocation Via Plain kfree In inet_sock_destruct: Since upstream commit 079096f103fa (merged in Linux 4.4 to install SYN_RECV request sockets into the established hash table), request sockets are processed without holding the parent listener lock. Furthermore, TCP child sockets do not set the SOCK_RCU_FREE flag. If the newly created child socket is rapidly closed and destroyed, inet_sock_destruct() releases newinet->inet_opt immediately using a plain kfree() call rather than deferring deallocation across an RCU grace period.

[+] Concurrent SYNACK Option Read In ip_options_build: While CPU Core A tears down the child socket and frees inet_opt, CPU Core B can simultaneously process a retransmitted SYN packet matching the same request socket via tcp_check_req(). Under rcu_read_lock() protection alone, tcp_v4_send_synack() and inet_csk_route_req() dereference ireq->ireq_opt and invoke ip_build_and_send_pkt() and ip_options_build(), which read opt->optlen twice from freed slab memory. This double fetch and use after free condition enables out of bounds memory reads in outbound SYNACK packets and subsequent heap corruption.

[+] Secondary Race Condition In Request Socket Migration: A parallel use after free path exists when request socket migration is enabled via sysctl net.ipv4.tcp_migrate_req=1 or an attached BPF_SK_REUSEPORT_SELECT_OR_MIGRATE eBPF program. During socket migration, reqsk_timer_handler() clones the request socket via inet_reqsk_clone(), leaving the original request socket and its clone pointing to the same ireq_opt buffer before reqsk_migrate_reset() clears the old pointer. If the cloned request socket is destroyed via tcp_v4_reqsk_destructor(), which also invokes plain kfree(), another processor core holding a reference to the original request socket accesses freed option memory.

[+] Architectural Contrast With IPv6 Option Duplication: The primary handshake race does not affect standard IPv6 TCP connections because tcp_v6_syn_recv_sock() explicitly duplicates ipv6_opt memory when instantiating the child socket. However, tcp_v6_reqsk_destructor() shares the secondary migration defect when Common Architecture Label IPv6 Security Option (CALIPSO) labels are active.

[+] CVSS Scoring Divergence Across Linux Vendors: While the Linux kernel CVE assignment team and the National Vulnerability Database assign CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), Red Hat Product Security, SUSE Security, and Wiz Research score the flaw at 8.1 (AC:H), and Amazon Web Services scores it at 7.0, reflecting differing interpretations of multi core race complexity versus the ability of an attacker to retry failed handshakes indefinitely without crashing the target kernel.

Chapter 03 - Operational Response

Because Canonical Ubuntu Server and Red Hat Enterprise Linux estates remain in an unpatched exposure window as of October 30, 2026, security teams must layer kernel updates on patched distributions with immediate nftables packet filtering and Multipath TCP restriction on unpatched hosts.

[+] Deploy Upstream And Distribution Patched Kernels: Upgrade Linux hosts immediately where vendor packages are available, specifically upstream stable kernels 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7, Debian 12 Bookworm (6.1.190-1), Debian 13 Trixie (6.12.113-1), Amazon Linux 2023 (kernel 6.18.56-125.164.amzn2023 and kernel6.12 6.12.113-138.209.amzn2023), and SUSE Linux Enterprise Server 15 SP4, 15 SP5, and 16.0 (advisories SUSE-SU-2026:24386-1 and SUSE-SU-2026:24422-1). Verify that container host nodes and Kubernetes worker nodes are rebooted into the updated kernel image.

[+] Drop Inbound IPv4 TCP Packets Containing IP Options Via nftables: Because CVE-2026-98432 requires IPv4 options (such as Record Route or Timestamp) to populate ireq_opt, and standard internet TCP traffic carries a 20 byte IPv4 header without options (header length word count of 5), administrators on unpatched Canonical Ubuntu Server and Red Hat Enterprise Linux hosts should drop IPv4 TCP packets where ip hdrlength exceeds 5 in the prerouting hook at priority -300 prior to connection tracking. Do not apply this rule on internal networks utilizing Commercial IP Security Option (CIPSO) NetLabel packet tagging for SELinux or Smack.

[+] Audit And Disable Multipath TCP Listeners And Go Runtime Defaults: Execute ss -lnMp across all host and container network namespaces to identify active MPTCP listening sockets. Set sysctl -w net.mptcp.enabled=0 in /etc/sysctl.d/99-disable-mptcp.conf across every network namespace and restart any services currently bound to MPTCP sockets, as toggling the sysctl parameter does not close existing listeners. For applications compiled with Go 1.24 or newer, export the environment variable GODEBUG=multipathtcp=0 or declare godebug multipathtcp=0 in go.mod prior to restarting the service.

[+] Disable Request Socket Migration To Close Secondary Race Vector: Verify that request socket migration is disabled across all Linux servers by setting sysctl -w net.ipv4.tcp_migrate_req=0 and auditing loaded eBPF programs via bpftool prog list to confirm no BPF_SK_REUSEPORT_SELECT_OR_MIGRATE logic is migrating half open request sockets without upstream patch commit e3f33b0a1d89d738e2b913dab519226eaf76e15b.

[+] Forensic Triage Of Kernel Ring Buffers And SYN Retransmission Bursts: Inspect kernel logs via dmesg and journalctl -k for KASAN reports, general protection faults, or kernel oops call traces referencing ip_options_build, ip_build_and_send_pkt, tcp_v4_send_synack, or inet_csk_route_req. Because failed race attempts silently abort the handshake without crashing the host, correlate host inspection with network flow telemetry to detect single source IPv4 addresses transmitting sustained bursts of TCP SYN packets with IPv4 header length greater than 20 bytes over 45 to 60 minute windows.

Timestamp (UTC)	Phase	Entity Involved	Operational Milestone Summary
2015-10-02T00:00:00Z	Vulnerability Introduction	Linux Kernel Organization	Commit 079096f103fa merges in Linux 4.4, enabling lockless request socket processing in ehash table.
2026-10-05T14:20:00Z	Upstream Remediation	Linux Kernel Organization	Eric Dumazet authors commit e3f33b0a1d89d738e2b913dab519226eaf76e15b replacing kfree with kfree_rcu for inet_opt and ireq_opt.
2026-10-15T10:00:00Z	CVE Publication	Linux Kernel CVE Team	CVE-2026-98432 is formally published and assigned to the IPv4 TCP option use after free defect.
2026-10-15T16:00:00Z	Vendor Triage	Canonical & Red Hat	Canonical Ubuntu Security and Red Hat Product Security publish initial tracking advisories for CVE-2026-98432.
2026-10-24T12:00:00Z	Severity Scoring	Linux Kernel CVE Team	Linux kernel CVE team scores CVE-2026-98432 at CVSS v3.1 9.8 Critical.
2026-10-27T15:00:00Z	Exploit Research Disclosure	Anthropic Research	Anthropic discloses that an internal Claude model discovered CVE-2026-98432 and built a 53 minute remote root exploit against MPTCP listeners.
2026-10-29T12:04:53Z	Distribution Patch Release	SUSE Security	SUSE publishes security advisories SUSE-SU-2026:24386-1 and SUSE-SU-2026:24422-1 patching SLES 15 SP4, 15 SP5, and 16.0.
2026-10-29T18:00:00Z	Ecosystem Warning	Go Security Team	Go Security Team warns that Go 1.24 and 1.25 enable Multipath TCP by default on Linux listening sockets and advises GODEBUG=multipathtcp=0.
2026-10-30T09:00:00Z	Ongoing Patch Gap	Canonical & Red Hat	Ubuntu 16.04 LTS through 26.10 remain marked work in progress and RHEL 8, 9, and 10 remain unpatched in deferred status.

Chapter 04 - Detection Intelligence

title: Linux Kernel CVE-2026-98432 IPv4 TCP Options Use After Free Crash Or Exploit Attempt
id: 9b4e7c12-6d3a-4f89-81b2-5e9a3c4d7e01
status: experimental
description: Detects kernel oops, KASAN slab use after free warnings, or general protection faults inside ip_options_build and tcp_v4_send_synack associated with CVE-2026-98432 exploitation or race probing.
references:
  - hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2026-98432
  - hxxps://www[.]anthropic[.]com/research/discovering-vulnerabilities-with-claude
author: Inferlume CTI
date: 2026/10/30
tags:
  - attack.initial_access
  - attack.privilege_escalation
  - attack.t1190
  - attack.t1068
  - cve.2026.98432
logsource:
  product: linux
  service: syslog
detection:
  selection_functions:
    Message|contains:
      - 'ip_options_build'
      - 'ip_build_and_send_pkt'
      - 'tcp_v4_send_synack'
      - 'inet_csk_route_req'
      - 'tcp_v4_reqsk_destructor'
  selection_fault:
    Message|contains:
      - 'BUG: KASAN: slab-use-after-free'
      - 'general protection fault'
      - 'Unable to handle kernel paging request'
      - 'Oops:'
  condition: selection_functions and selection_fault
falsepositives:
  - Unrelated hardware memory corruption affecting kernel networking stack
level: critical

rule EXPL_Linux_CVE_2026_98432_TCP_Options_Race_PoC {
    meta:
        description = "Detects exploit scripts and compiled binaries targeting Linux kernel CVE-2026-98432 IPv4 TCP option race condition"
        author = "Inferlume CTI"
        date = "2026-10-30"
        cve = "CVE-2026-98432"
        severity = "Critical"
    strings:
        $str1 = "CVE-2026-98432" ascii wide nocase
        $str2 = "ip_options_build" ascii
        $str3 = "tcp_v4_syn_recv_sock" ascii
        $str4 = "ireq_opt" ascii
        $net1 = "IPOPT_RR" ascii
        $net2 = "IPOPT_TIMESTAMP" ascii
        $net3 = "IPPROTO_MPTCP" ascii
        $raw_rr = { 47 00 ?? ?? ?? ?? 00 00 }
    condition:
        (uint32(0) == 0x464c457f or filesize < 2MB) and
        (
            ($str1 and 1 of ($net*)) or
            (2 of ($str2, $str3, $str4) and 1 of ($net*)) or
            ($raw_rr and $net3)
        )
}

# Suricata IDS / IPS Signature for CVE-2026-98432 IPv4 Options SYN Flood Probing
drop tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Linux Kernel CVE-2026-98432 IPv4 Options TCP SYN Race Attempt"; ipopts: any; flags:S,12; threshold: type both, track by_src, count 50, seconds 10; reference:cve,2026-98432; classtype:attempted-admin; sid:2026984321; rev:1;)

# Emergency nftables Prerouting Filter (Priority -300 Before Connection Tracking)
sudo nft add table ip cve_2026_98432
sudo nft add chain ip cve_2026_98432 pre '{ type filter hook prerouting priority -300; }'
sudo nft add rule ip cve_2026_98432 pre meta l4proto tcp ip hdrlength gt 5 counter drop

Indicator Value	Indicator Type	Threat Role	Recommended Action
e3f33b0a1d89d738e2b913dab519226eaf76e15b	Git Commit Hash	Upstream Linux Kernel Patch Commit	Verify presence in distribution kernel changelog or git tree
079096f103fa	Git Commit Hash	Vulnerability Introducing Commit (Linux 4.4)	Identify historical baseline exposure across kernel lineages
ip_options_build	Kernel Function Symbol	Vulnerable Dereference Site in IPv4 Stack	Monitor kernel ring buffer and KASAN telemetry for faults
tcp_v4_syn_recv_sock	Kernel Function Symbol	Ownership Transfer Function Without RCU Copy	Audit livepatch modules and kernel symbols
net.mptcp.enabled=1	Sysctl Parameter	Multipath TCP Listener Exposure Enabler	Set to 0 across all host and container network namespaces
ip hdrlength gt 5 && tcp.flags.syn == 1	Network Packet Signature	IPv4 TCP SYN Packet Carrying IP Options	Drop at nftables prerouting priority -300 and inline IPS

-- osquery SQL Query: Identify Linux Hosts With Active Multipath TCP Listeners And Vulnerable Sysctl State
SELECT
  s.Item AS sysctl_key,
  s.Value AS sysctl_value,
  p.pid,
  p.name AS process_name,
  p.cmdline,
  pos.local_address,
  pos.local_port,
  pos.protocol
FROM (
  SELECT name AS Item, config_value AS Value
  FROM system_controls
  WHERE name IN ('net.mptcp.enabled', 'net.ipv4.tcp_migrate_req')
) s
LEFT JOIN process_open_sockets pos ON pos.state = 'LISTEN'
LEFT JOIN processes p ON pos.pid = p.pid
WHERE s.Value = '1';

// Elastic / Kibana KQL Query: Detect Sustained IPv4 Options TCP SYN Probing Or Post Exploit Kernel Faults
(network.transport: "tcp" AND network.type: "ipv4" AND source.packets > 500 AND destination.packets > 500)
OR
(event.dataset: "system.syslog" AND message: (*ip_options_build* OR *tcp_v4_send_synack* OR *inet_csk_route_req*))

# Host Verification Script For Ubuntu, RHEL, And Go MPTCP Listeners
echo "[+] Checking Running Kernel And Distribution Patch Changelog..."
uname -r
if [ -f "/usr/share/doc/linux-modules-$(uname -r)/changelog.Debian.gz" ]; then
  zgrep -c CVE-2026-98432 "/usr/share/doc/linux-modules-$(uname -r)/changelog.Debian.gz"
elif command -v rpm >/dev/null 2>&1; then
  rpm -q --changelog "kernel-core-$(uname -r)" | grep -c CVE-2026-98432
fi
echo "[+] Inspecting Active Multipath TCP Listeners..."
sudo ss -lnMp
echo "[+] Checking Kernel Sysctl Exposure..."
sysctl net.mptcp.enabled net.ipv4.tcp_migrate_req

MITRE ATT&CK Tactic	Technique ID	Technique Name	Observed Or Demonstrated Adversarial Procedure
Reconnaissance (TA0043)	T1595.002	Active Scanning: Vulnerability Scanning	Probing target Linux servers for active Multipath TCP listeners and acceptance of IPv4 Record Route or Timestamp header options.
Initial Access (TA0001)	T1190	Exploit Public Facing Application	Transmitting concurrent IPv4 TCP SYN and retransmitted SYN packets with IPv4 options over 48 minutes to leak KASLR pointers and hijack control flow.
Privilege Escalation (TA0004)	T1068	Exploitation for Privilege Escalation	Overwriting a kernel callback function pointer via the ireq_opt use after free primitive to achieve Ring 0 execution from unauthenticated network traffic.
Execution (TA0002)	T1059.004	Command and Scripting Interpreter: Unix Shell	Executing arbitrary shell commands with root privileges on the compromised Linux server approximately 5 minutes after defeating KASLR.
Impact (TA0040)	T1499.001	Endpoint Denial of Service: OS Exhaustion Flood	Triggering unaligned slab memory access or kernel oops in ip_options_build when race conditions corrupt unmapped kernel pointers.

MITRE D3FEND ID	Countermeasure Name	Defensive Implementation Guidance
D3-NTFF	Network Traffic Filtering	Enforce nftables prerouting filter (ip hdrlength gt 5 drop) and RFC 7126 router filtering to strip or drop IPv4 packets carrying Record Route or Timestamp options.
D3-SU	Software Update	Apply upstream Linux kernel commit e3f33b0a1d89d738e2b913dab519226eaf76e15b via distribution kernel packages and reboot worker nodes.
D3-SCH	System Configuration Hardening	Disable Multipath TCP socket creation (net.mptcp.enabled=0), disable request socket migration (net.ipv4.tcp_migrate_req=0), and set GODEBUG=multipathtcp=0 for Go 1.24+ binaries.
D3-NI	Network Isolation	Restrict direct public internet reachability to Linux application listeners using cloud security groups and reverse proxies that terminate TCP connections cleanly.

Chapter 05 - Governance, Risk & Compliance

Although CVE-2026-98432 has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of October 30, 2026, its CVSS 9.8 rating and demonstrated AI generated remote root exploit trigger strict vulnerability management SLA requirements across regulated sectors.

[+] PCI DSS v4.0 Requirement 6.3.3 Compliance Mandates: Payment Card Industry Data Security Standard (PCI DSS) v4.0 Requirement 6.3.3 mandates that organizations patch Critical and High severity vulnerabilities within 30 days of identification. Where Canonical Ubuntu Server and Red Hat Enterprise Linux patches remain unreleased, regulated entities must document and enforce compensating controls (specifically nftables IPv4 option dropping and MPTCP listener deactivation) to maintain compliance.

[+] Cloud Shared Responsibility And Container Host Governance: Under cloud shared responsibility frameworks across Amazon Web Services, Microsoft Azure, and Google Cloud Platform, managed container nodes (such as Amazon EKS, Azure AKS, and self managed Kubernetes clusters) run on customer managed Linux virtual machine kernels. Updating container application images does not remediate CVE-2026-98432; governance teams must enforce host node AMI rotation and kernel reboot verification.

[+] Enterprise Risk Acceptance For Deferred Vendor Fixes: Because Red Hat Enterprise Linux currently lists CVE-2026-98432 under Fix Deferred status and Canonical Ubuntu packages remain in work in progress status as of October 30, 2026, Chief Information Security Officers must formally register risk exceptions for internet reachable RHEL 8, 9, and 10 and Ubuntu 16.04 LTS through 26.10 assets until verified kernel packages or kpatch/Livepatch modules are deployed.

Chapter 06 - Adversary Emulation

To validate defensive controls safely without triggering kernel memory corruption or race conditions, security engineering teams should execute the following non destructive verification steps in a staging Linux environment.

[+] Step 1 Verify Active MPTCP Socket Enumeration And Go Fallback: In a staging Canonical Ubuntu 24.04 or 26.04 VM, launch a test listener compiled with Go 1.24 or newer and run sudo ss -lnMp to confirm the socket binds with the MPTCP protocol. Next, relaunch the service with GODEBUG=multipathtcp=0 and set sudo sysctl -w net.mptcp.enabled=0, then re run sudo ss -lnMp to verify zero MPTCP listeners remain active.

[+] Step 2 Validate nftables Prerouting Drop Rule With Single Ping Or TCP Probe: Apply the emergency nftables prerouting rule (meta l4proto tcp ip hdrlength gt 5 counter drop) on the staging host. From an adjacent test client, send a single benign TCP SYN packet containing a standard IPv4 Timestamp option using Scapy or hping3 (--ipopt ts) toward an open staging port, and run sudo nft list table ip cve_2026_98432 to confirm the drop packet counter increments cleanly while standard 20 byte IPv4 TCP handshakes succeed without latency.

[+] Step 3 Verify SIEM Alerting Via Simulated Syslog Injection: Inject a synthetic syslog test event on the staging host using logger "kernel: [10420.112] BUG: KASAN: slab-use-after-free in ip_options_build+0x84/0x1b0" and verify that the Elastic KQL and Sigma detection rules generate a high priority SOC alert within the target Mean Time To Detect (MTTD) window.

Intelligence Confidence96%

Analytical confidence is high based on direct verification of upstream Linux kernel patch commit e3f33b0a1d89d738e2b913dab519226eaf76e15b authored by Eric Dumazet, official CVE record publication by the Linux kernel CVE assignment team assigning CVSS 9.8, and primary technical exploit research published by Anthropic researcher Xinyang Ge. Distribution exposure status is corroborated across Canonical Ubuntu Security, Red Hat Customer Portal, SUSE Bugzilla, Debian Security Tracker, and Amazon Linux advisories. Active wild exploitation has not been recorded by CISA Known Exploited Vulnerabilities or vendor telemetry as of October 30, 2026, though functional remote root proof of concept capability has been demonstrated in controlled research environments.