tl;dr: A remote, unauthenticated use-after-free in Linux's IPv4 TCP handshake (CVE-2026-98432, CVSS 9.8) affects kernels since 4.4, with Anthropic claiming Claude built a working root exploit against servers running multipath TCP listeners—which Go programs enable by default since 1.24. Upstream fixes shipped Oct 11–18 via a four-line change (kfree → kfree_rcu), but as of Oct 31 Ubuntu and RHEL 8/9/10 remain unpatched. Interim mitigations include nftables/iptables rules dropping IPv4 TCP packets carrying IP options and disabling MPTCP.