Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH036

LH036 reads: 5 November 2026

Thursday read at 14:14 UTC (label 2026-11-05T1414Z)

The scheduled Thursday read (row LH036-2026-11-05). The collector started at 14:14:53 UTC and finished at 14:14:58 UTC; all 12 URLs answered HTTP 200 (read log). The kernel CVE team's announcement on git.kernel.org again returned the "Making sure you're not a bot!" challenge page, so it is unavailable at this read, as at the two before. Figures from tables.json, rewritten by scripts/tabulate.py over all three reads, and checked against the raw files; the comparison is with the read of 2 November at 15:26 UTC (checkpoint), so every change below was observed in the interval after 2026-11-02T15:26Z and at or before 2026-11-05T14:14Z, with each source's own date beside it. Written by a Claude Code subagent of the scheduled run of 5 November 2026 (Claude Opus 5.5, as reported by its harness). Model disclosure: the exploit and the post are Anthropic's, and this session runs on an Anthropic model.

In short: no KEV listing, no CISA ADP container, no EPSS step. EPSS rose from 0.00457 to 0.0076 on 3 November, a factor of about 1.66, below the brief's factor of two. Red Hat lists 12 new fixed releases under 9 advisories, and SUSE now marks a main kernel package Released for 17 more products, among them SUSE Linux Enterprise Server 15 SP7 and openSUSE Leap 15.4 to 15.6. Debian and Ubuntu released no new fix for any release; Ubuntu raised its priority from high to critical and added a mitigation. Red Hat's and Ubuntu's descriptions now name remote code execution. The three watched pages changed in their bytes, but not in what they say about this CVE.

EPSS (measure 1; derived from the API's series). Two new dates: 3 November 0.0076 (percentile 0.55326) and 4 November 0.0076 (percentile 0.55396). The day before, 2 November, was 0.00457 (percentile 0.39649). The ratio 0.0076 / 0.00457 is 1.663, so under the brief's definition (a day-on-day change by a factor of two or more) this is not a step. The only step in the series remains 25 October (0.00165 to 0.00388, a factor of 2.35), as tabulate.py also reports. The API's values for every date already held were the same at this read as at the earlier ones. No cause is read into the rise.

KEV (measure 2). Not listed. The catalogue served was a newer version than at the last two reads: 2026.11.04, released 2026-11-04T20:00:05Z (Last-Modified Wed, 04 Nov 2026 20:00:05 GMT), with 1,768 entries against 1,766 in 2026.10.30. Its two new entries are other CVEs (CVE-2026-119977, dateAdded 2026-11-03, and CVE-2024-27834, dateAdded 2026-11-04). No string "98432" appears anywhere in the catalogue. Any catalogue version published between 30 October and 4 November was not seen.

The record (measure 3).

  • CVE record: dateUpdated 2026-11-03T06:08:32Z (2026-10-31T21:04:43Z at the last read). The only change is in the CVE Program's ADP container, whose own dateUpdated is the same, 2026-11-03T06:08:32Z: one new reference, http://www.openwall.com/lists/oss-security/2026/11/03/1, its fourth. The CNA container is unchanged (dateUpdated 2026-10-24T14:08:46Z, CVSS 3.1 9.8, same vector). Still one ADP container; no CISA ADP container, and so no SSVC values.
  • NVD: lastModified 2026-11-03T07:20:59Z (2026-10-31T21:16Z at the last read); vulnStatus still Received. The only metric is still the CNA's CVSS 3.1 9.8, typed Secondary; no NVD score, and no configurations or weaknesses. References went from 11 to 12, the new one the same oss-security post of 3 November.
  • OSV: modified 2026-11-04T17:27:21Z (2026-11-02T12:26:58Z at the last read).
    • Related grew from 20 to 70; none was removed. All 50 new ids are SUSE's, listed as OSV gives them and not opened: SUSE-SU-2026:24479-1 to SUSE-SU-2026:24512-1 (34 consecutive numbers, every one present), and SUSE-SU-2026:5012-1, 5016-1, 5019-1, 5020-1, 5034-1, 5048-1, 5052-1, 5053-1, 5055-1, 5058-1, 5059-1, 5084-1, 5085-1, 5086-1, 5088-1 and 5091-1.
    • References went from 14 to 15; the new one is the oss-security post of 3 November. The others only moved position in the list.
  • The oss-security post of 3 November was not opened; what it says is not known here.

Fixes (measure 4; observation, as each tracker gives it).

  • Red Hat: newly fixed. The affected_release list went from 6 rows to 18; none of the 6 earlier rows changed. The 12 new rows, with Red Hat's own dates (each a day with a midnight time, recorded beside the interval, not substituted for it):

    • NVIDIA for RHEL 10, kernel-0:6.12.0-265.31.el10nv, RHSA-2026:93775, 2 November;
    • RHEL 9.4 Update Services for SAP Solutions, kernel-0:5.14.0-427.161.1.el9_4, RHSA-2026:94109, 2 November;
    • RHEL 10.0 Extended Update Support, kernel-0:6.12.0-55.117.1.el10_0, RHSA-2026:94508, 3 November;
    • RHEL 9.6 Extended Update Support, kernel-0:5.14.0-570.154.1.el9_6, RHSA-2026:94438, 3 November;
    • RHEL 9.2 Update Services for SAP Solutions, kernel-0:5.14.0-284.202.1.el9_2, RHSA-2026:94477, 3 November;
    • RHEL 9.2 Update Services for SAP Solutions (CPE rhel_e4s:9.2::nfv), kernel-rt-0:5.14.0-284.202.1.rt14.487.el9_2, RHSA-2026:94558, 3 November;
    • RHEL 8.8 Telecommunications Update Service and RHEL 8.8 Update Services for SAP Solutions, kernel-0:4.18.0-477.178.1.el8_8, RHSA-2026:94303, 3 November (two rows);
    • RHEL 8.4 Advanced Mission Critical Update Support and RHEL 8.4 Extended Update Support Long-Life Add-On, kernel-0:4.18.0-305.218.1.el8_4, RHSA-2026:94623, 3 November (two rows);
    • RHEL 8.6 Advanced Mission Critical Update Support and RHEL 8.6 Extended Update Support Long-Life Add-On, kernel-0:4.18.0-372.227.1.el8_6, RHSA-2026:94996, 4 November (two rows).

    Two releases dated 2 November by Red Hat may have appeared before or after the last read at 15:26 UTC that day; the record cannot say which. The package_state list went from 8 rows to 7:

    • RHEL 9 kernel-rt, Affected at the last read, is no longer listed. No fixed release under "Red Hat Enterprise Linux 9" for kernel-rt appears; the only new kernel-rt row is RHEL 9.2's above. Red Hat does not say here why the row went.
    • Red Hat Enterprise Linux for NVIDIA 26, Affected at the last read (CPE cpe:/a:redhat:enterprise_linux_nvidia:), is no longer listed. The new fixed release "NVIDIA for RHEL 10" carries CPE cpe:/a:redhat:enterprise_linux_nvidia:10::el10; whether Red Hat means the same product is not stated, and is not assumed here.
    • New, Affected: Red Hat Enterprise Linux AI (RHEL AI) 3, kernel.
    • Unchanged: OpenShift Container Platform 4 (ose-rhel-coreos-8 and ose-rhel-coreos-9) and 5 (ose-rhel-coreos-9), Affected; RHEL 6 and 7 Not affected, though their CPEs changed from enterprise_linux:6 and :7 to rhel_els:6 and rhel_els:7.

    Red Hat's description changed in its last sentence, from "This issue primarily results in a system crash leading to a Denial of Service (DoS) or potential memory corruption." to "This could results in system crash leading to a Denial of Service (DoS), memory corruption, or remote code execution." (quoted as given). CVSS 9.8 verified and threat severity Critical, unchanged.

  • Debian: no suite changed status. trixie (security) moved from 6.12.113-1 to 6.12.115-2, still fixed; its fixed-version entry is still 6.12.113-1 under DSA-6568-1, and no new DSA or DLA id is listed (references still DLA-4841-1, DLA-4850-1 and DSA-6568-1). Every other row is as before: bookworm 6.1.176-1 vulnerable, bookworm (security) 6.1.190-1 fixed, trixie 6.12.107-1 vulnerable, forky 7.2.12-1 fixed, sid 7.2.15-1 fixed, linux-6.12 in bookworm (security) 6.12.113-1~deb12u1 fixed.

  • Ubuntu: no Ubuntu release has a released fix, and no Ubuntu notice is listed. Ubuntu's own updated_at is 2026-11-05T10:05:34Z (2026-10-30T19:44:25Z at the last read).

    • Priority high to critical.
    • The linux package is unchanged: pending in stonking (7.3.0-10.10), jammy (5.15.0-203.213), noble (6.8.0-149.149) and resolute (7.0.0-43.43); needed in bionic, focal and xenial; not affected in trusty.
    • Of the other kernel packages, 26 rows went from needed to pending, each with a version (3 in focal, 9 in jammy, 10 in noble, 4 in resolute; among them linux-hwe-7.0 in noble, linux-hwe-5.15 in focal, linux-raspi in jammy, noble and resolute, and several linux-nvidia and linux-azure-fde packages). Two rows already pending gained or changed a version (linux-riscv-5.15 in focal, linux-riscv-6.8 in jammy). Across all packages, needed rows went from 76 to 50 and pending from 68 to 94; bionic, xenial and trusty did not change.
    • The description now opens: "This vulnerability affects the IPv4 TCP connection handling in the Linux kernel and can lead to remote code execution."
    • The CVSS 4.0 entry in the record's impact field changed from 8.3 (HIGH, VC:L/VI:L/VA:H) to 9.2 (CRITICAL, VC:H/VI:H/VA:H); the CVSS 3.1 entry is unchanged at 9.8.
    • A mitigation was added, headed "cengizcan> IPv4 TCP packet filtering": an nftables rule that "Blocks: incoming IPv4 TCP packets that contain IP options", with the note "Limit: reduces the risk but does not fully prevent exploitation."
    • A new reference: https://ubuntu.com/blog/fixes-available-in-proposed-pocket-for-cve-2026-98432, not opened.

  • SUSE: overall state Pending, as before (Last-Modified Thu, 05 Nov 2026 13:17:39 GMT). Counted by the rule of the earlier checkpoints, products with at least one main kernel package (kernel-default, kernel-source, kernel-rt or kernel-64kb): 115 products (112 at the last read); 35 only Released (18), 1 Released and Affected (1), 73 only Affected (81), 2 only In progress (6), 0 Affected and In progress (2), 4 Not affected (4).

    • Newly with a Released main kernel package, 17 products:

      • SUSE Linux Enterprise Desktop, Server, Server for SAP Applications, Workstation Extension, Module for Basesystem and Module for Legacy, all 15 SP7, from In progress (6);
      • Module for Development Tools 15 SP7, from Affected and In progress, now only Released;
      • High Availability Extension 15 SP7, from Affected and In progress to Affected and Released (kernel-default Released, kernel-source still Affected);
      • SUSE Linux Micro 6.0 and 6.1 and Micro Extras 6.0 and 6.1, from Affected (4);
      • openSUSE Leap 15.4, 15.5 and 15.6, from Affected (3);
      • SUSE Linux Enterprise Micro for Rancher 5.3 and 5.4, new to the page and Released (2).

      The 15 SP7 products list kernel packages at 6.4.0-150700.53.90.1 under patch names ending 2026-5091, the same number as OSV's SUSE-SU-2026:5091-1; that is a match of strings, not a check of builds.

    • SUSE Linux Enterprise Micro 5.3 went from Affected and Released to only Released (its kernel-rt row, Affected to Released).

    • SUSE Linux Enterprise Server 12 SP5-LTSS and LTSS Extended Security 12 SP5 went from Affected to In progress.

    • openSUSE Leap 16.1 is new to the page, kernel-source Affected.

    • The live patches, which that count leaves out:

      • 32 rows under SUSE Linux Enterprise Live Patching went from In progress to Released (7 for 12 SP5, 6 for 15 SP4, 2 for 15 SP5, 3 for 15 SP6, 14 for 15 SP7);
      • the 19 kernel-livepatch-SLE16-RT rows under SUSE Linux Micro 6.2 went from In progress to Released;
      • live-patch rows are listed again under SUSE Linux Micro 6.0 (34) and 6.1 (32), all Released, and are new under openSUSE Leap 15.4 (16), 15.5 (14) and 15.6 (16), all Released;
      • 11 new kernel-livepatch-SLE16_Update rows under SUSE Linux Micro 6.2, In progress;
      • under SUSE Linux Enterprise Server 16.0 and Server for SAP applications 16.0, kernel-livepatch-SLE16_Update_7 (In progress) is replaced by kernel-livepatch-SLE16_Update_18 (In progress).

    The page has 560 product and package rows, against 424 at the last read. Whether a Released live patch covers a given running kernel is not read here.

The pages (measure 5).

  • Anthropic's post: bytes changed, article text unchanged. The body hash changed (864937599e..., against e18f2a98f6...) and so did the extracted text's hash (59150e48..., against af1a8e17...). The only text difference is 11 lines of page furniture added after the lines "Team" and "Frontier Red Team": a "Topics" list ("Cybersecurity", "Red teaming", "Safety evaluations", "Coding", "See more...") and a "Related articles" box linking "Expanding the Cyber Verification Program" (Announcements, Oct 6, 2026). The article's own text, from "Over the past few months, we’ve used an unreleased, internal research model" on, is the same as at the last read. dateModified is still 2026-10-30T15:24:16Z.
  • AlmaLinux's post: bytes changed, post text unchanged. The only text difference is two lines added to the site's navigation menu ("AlmaLinux for..." and "AlmaLinux for Media and Entertainment"). The post's title, update notice and changelog are as at the last read. No dateModified is given.
  • Kernel announcement: unavailable, still the Anubis "Making sure you're not a bot!" challenge (7,346 bytes of HTML). Its hash changes at every fetch because the challenge carries its issue time. At this read the challenge also reports a newer Anubis version (v1.28.2, against v1.26.2) and a shorter explanatory text. The announcement itself was not read.

Not checked: the oss-security post of 3 November; the 50 new OSV advisories' own pages; Red Hat's RHSA pages; Ubuntu's blog post and its proposed pocket; SUSE's advisory pages; whether any fixed package was installed or a machine rebooted into it. The helper scripts for these comparisons were run outside the repository and are not kept with the record; each comparison above can be repeated from the two reads' raw files.

For the commit message. No KEV listing (catalogue 2026.11.04 read). No CISA ADP container. No EPSS step: 0.00457 to 0.0076 on 3 November is a factor of 1.66. Newly fixed releases: Red Hat, 12 rows under RHSA-2026:93775, 94109, 94303, 94438, 94477, 94508, 94558, 94623 and 94996; SUSE, 17 products newly with a Released main kernel package (among them SLES 15 SP7, SUSE Linux Micro 6.0 and 6.1, and openSUSE Leap 15.4 to 15.6), plus live patches; none for Debian or Ubuntu. Changed pages: Anthropic's post, AlmaLinux's post and the kernel announcement's challenge page changed in bytes only (furniture, navigation and challenge), with no change to what they say about this CVE.

Rows: LH036-2026-11-05 done.

From studies/LH036/checkpoints/2026-11-05.md in the repository, last changed 5 November 2026.