alt Hacker NewsI don't think this is fair. They don't do a good job of pointing you at their rationale which is in their security score here[0]. I ultimately had to have claude translate the kernelese in to something my small brain could understand but this is a bug that could crash your system but is unlikely to expose your confidential system data to attackers or degrade data on the system. Especially given that the exploit can only be done if packets with IP options. IP options are commonly dropped or removed from packets on the open web. You not only need a vulnerable system but a vulnerable request path through the internet which you would only know by trying this attack which is very timing dependent with the SYN,Retransmitted SYN and Reset all happening very close together. A motivated attacker could probably do this on your network but over the internet ... It sounds unlikely.
Replies
> this is a bug that could crash your system but is unlikely to expose your confidential system data to attackers or degrade data on the system
Red Hat disagrees[0][1]. They might be parroting Anthropic, and Anthropic might be exagerating the impact (likely!), but that's the current consensus about the vulnerability. If Ubuntu disagrees, they should have said something and not pasted "Cvss 3 Severity Score 9.8 · Critical" at the top of the page.
> A motivated attacker could probably do this on your network
I find that's still catastrophic given how centralized cloud environments are.
[0] https://access.redhat.com/security/cve/cve-2026-98432
[1] https://access.redhat.com/security/vulnerabilities/RHSB-2026...
What about an untrusted local network, like public wifi?
> but this is a bug that could crash your system but is unlikely to expose your confidential system data to attackers
Given people have demonstrated getting root with it, unlikely seems questionable
> Especially given that the exploit can only be done if packets with IP options. IP options are commonly dropped or removed from packets on the open web.
It sounds like iphones use mptcp in the wild, which use tcp options, so im not sure how true this is.
Greg Kroah-Hartman the long-time Linux kernel maintainer (USB, PCI, driver core, sysfs, and -stable releases) gave a talk on LLM assisted CVE discoveries. In that talk, he downplayed those exposed CVEs from Mythos. What you described above matches his sentiment on downgrade those CVE vuln score.
See previous discussion and the actual talk on YouTube:
https://news.ycombinator.com/item?id=49929391