I don't think this is fair. They don't do a good job of pointing you at their rationale which is in their security score here[0]. I ultimately had to have claude translate the kernelese in to something my small brain could understand but this is a bug that could crash your system but is unlikely to expose your confidential system data to attackers or degrade data on the system. Especially given that the exploit can only be done if packets with IP options. IP options are commonly dropped or removed from packets on the open web. You not only need a vulnerable system but a vulnerable request path through the internet which you would only know by trying this attack which is very timing dependent with the SYN,Retransmitted SYN and Reset all happening very close together. A motivated attacker could probably do this on your network but over the internet ... It sounds unlikely.

[0]https://ubuntu.com/security/CVE-2026-98432#impact-score

▲

devy 17 minutes ago | parent | next [-]

Greg Kroah-Hartman the long-time Linux kernel maintainer (USB, PCI, driver core, sysfs, and -stable releases) gave a talk on LLM assisted CVE discoveries. In that talk, he downplayed those exposed CVEs from Mythos. What you described above matches his sentiment on downgrade those CVE vuln score.

See previous discussion and the actual talk on YouTube:

https://news.ycombinator.com/item?id=49929391

▲

BoppreH 44 minutes ago | parent | prev [-]

> this is a bug that could crash your system but is unlikely to expose your confidential system data to attackers or degrade data on the system

Red Hat disagrees[0][1]. They might be parroting Anthropic, and Anthropic might be exagerating the impact (likely!), but that's the current consensus about the vulnerability. If Ubuntu disagrees, they should have said something and not pasted "Cvss 3 Severity Score 9.8 · Critical" at the top of the page.

> A motivated attacker could probably do this on your network

I find that's still catastrophic given how centralized cloud environments are.

[0] https://access.redhat.com/security/cve/cve-2026-98432

[1] https://access.redhat.com/security/vulnerabilities/RHSB-2026...

	▲	WesternStar 20 minutes ago \| parent [-]
		> I find that's still catastrophic given how centralized cloud environments are. It's not like every cloud environment is vulnerable. GCP drops these options for example. > If Ubuntu disagrees, they should have said something and not pasted "Cvss 3 Severity Score 9.8 · Critical" at the top of the page. Again I'm going not going to argue they did a good job at pointing at their rationale but it looks like 9.8 is from CVSS 3.0 and they did prioritization with 4.0 which is 8.3. They definitely should have put that up front.