CVE-2026-98432 is a remote use-after-free in Linux IPv4 TCP connection setup, rated CVSS 9.8. Anthropic showed an exploit, written by Claude after initial prompting, that gets root on servers with a multipath TCP listener: 48 minutes to leak a kernel pointer, five more to reach a shell.

On CentOS 7 the answer depends on which kernel you boot.

  • Stock 3.10: not affected, per Red Hat.
  • ELRepo kernel-ml 6.9.7: the bug is present, and MPTCP is on by default. Go 1.24 and later open MPTCP listeners by default, and ss -lnt shows them as ordinary TCP.
  • ELRepo kernel-lt 5.4.278: the bug is present. There is no MPTCP, so the demonstrated chain does not apply, but the bug sits in the regular TCP path. Amazon patched its own 5.4 kernel.

Those two ELRepo versions are the final EL7 builds, from June 2024, so yum update has nothing to offer.

The fix

Disclosure: I maintain this package. GetPageSpeed's kernel-lt 6.18.60 uses the same package name, installs beside your current kernel, and is free for any use:

yum -y install https://extras.getpagespeed.com/release-latest.rpm yum -y install yum-utils yum-config-manager --enable getpagespeed-extras-corecare yum -y install kernel-lt grub2-set-default 0 grubby --default-kernel reboot

Do not skip grub2-set-default 0. On a server pinned to an ELRepo kernel, the new kernel installs but the old one stays the default.

I ran this on CentOS 7 VMs starting from both ELRepo kernels. The stopgaps for servers you cannot reboot yet, the rollback and the test results are in the full write-up.