The security industry is doing what it always does with CVE-2026-98432 and turning a narrow Linux kernel bug into a sales pitch.
Anthropic showed that an internal model could produce a remote root exploit against systems listening with Multipath TCP. While it’s interesting research, it’s not evidence that every Linux box on the internet is one packet away from root. IP options have caused network stack bugs for decades. Most of the internet learned to drop them long ago. Your phone is fine. Your laptop is fine. Your web tier behind a load balancer or CDN is also fine. The internet will be fine.
The exposure most environments already have is the pivot, where an attacker who already has a foothold in your network and can reach an unpatched Linux box that accepts IPv4 TCP connections without credentials. That same environment almost always contains bigger issues that are easier to exploit and usually already known if you ask your team.
A big chunk of the remaining risk sits on underfunded infrastructure that’s full of tech debt, never inventoried, or not configured since first deployed. I’ve seen it hundreds of times. Organizations keep buying tools while letting their existing tools sit untouched since they were first put in prod.
Infrastructure as code + AI tooling makes the basic work a dream. One playbook run gives every kernel version in the fleet. One IDS or firewall rule flags SYNs carrying IP options. Neither requires a new vendor. Configs, git, and a low-cost general AI subscription cover it, not project glasswing or some valley cyber darling.
You do not need another platform or a team of consultants. It’s market noise. You need an accurate inventory and the discipline to apply the configurations you already paid for.