Threshold tBTC operators patched their systems or went offline after researchers demonstrated an exploit for CVE-2026-98432, a critical 9.8 CVSS-rated Linux kernel TCP vulnerability. Anthropic revealed on October 27, 2026, that an AI model achieved remote root control in 53 minutes. Major distributions like Ubuntu and Red Hat delayed patches, prompting warnings to Solana validators and crypto infrastructure teams to block affected TCP options and disable MPTCP.
Threshold tBTC operations and reserves
- ▪Aave's frozen Ethereum Core reserve holds about $136.3 million of tBTC.
- ▪Threshold tBTC node operators patched their systems or went offline to protect against the critical CVE-2026-98432 Linux kernel vulnerability.
Details of CVE-2026-98432
- ▪CVE-2026-98432 is a use-after-free race condition in the IPv4 TCP connection handshake code, introduced in Linux 4.4 and patched upstream on October 5, 2026.
- ▪A flaw in the Linux kernel's TCP code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux, and other Linux distributions, carrying a CVSS severity rating of 9.8 out of 10 from the kernel CVE team.
Anthropic AI exploit development
- ▪An unreleased Anthropic Claude research model developed an exploit for CVE-2026-98432 that gains remote root access without credentials on Linux servers running a multipath TCP listener.
- ▪Anthropic reported on October 27, 2026, that its AI exploit took 48 minutes to leak a kernel address to bypass KASLR and 5 additional minutes to achieve arbitrary root command execution.
Linux vendor patches and ratings
- ▪Red Hat, Amazon, Oracle, and SUSE assigned CVSS severity scores between 5.9 and 8.1 to CVE-2026-98432, lower than the kernel team's 9.8 score, citing higher attack complexity.
- ▪Debian, Oracle Linux, SUSE, and Amazon Linux released fixed kernel packages for CVE-2026-98432, while Ubuntu and Red Hat Enterprise Linux had not released fixes as of early November 2026.
Solana validator mitigation guidance
- ▪Solana developer Anza and Solana Foundation lead Tim Garcia issued an urgent warning on November 1, 2026, advising mainnet-beta validators to apply temporary mitigations against CVE-2026-98432.
- ▪Solana Foundation validator relations lead Tim Garcia recommended that operators block incoming IPv4 TCP packets with options, disable MPTCP, and turn off TCP request-socket migration while Ubuntu patches remain pending.
Story comments
Loading comments…