The article sounds a bit sloppy.
In general this is a pretty low risk exploit. Can be used for trolling, but not to steal data or get rce.
The freed memory can be read again as the child socket is constructed, which leads to a use‑after‑free that can trigger a kernel crash or a denial of service. The vulnerability does not directly leak data.
The only mention I see of things beyond that are claims of rce on systems with multi-path tcp, which is rare.
This sounds like another overblown ai-company-discovered vulnerability. They have every reason to disclose poorly and create the biggest possible fear. Even the php exploit, which was a lot worse than this, still had way more publicity and fear than it deserved.
The article sounds a bit sloppy.
In general this is a pretty low risk exploit. Can be used for trolling, but not to steal data or get rce.
https://app.opencve.io/cve/CVE-2026-98432
The only mention I see of things beyond that are claims of rce on systems with multi-path tcp, which is rare.
This sounds like another overblown ai-company-discovered vulnerability. They have every reason to disclose poorly and create the biggest possible fear. Even the php exploit, which was a lot worse than this, still had way more publicity and fear than it deserved.