Linux Kernel Exploit Enables Remote Root Attacks on MPTCP Servers

Security researchers at Anthropic developed an exploit for CVE-2026-98432, a Linux kernel vulnerability that can let unauthenticated attackers run commands as root on servers with Multipath TCP (MPTCP) listeners. Anthropic said an unreleased Claude model developed the exploit, which took about 53 minutes to achieve remote code execution under specific conditions.

The flaw is a use-after-free bug in the kernel’s IPv4 TCP networking code and affects kernels dating back to version 4.4. The Linux kernel CVE team rated it 9.8 out of 10. Red Hat gave it a 5.9 severity score, citing the complexity of exploiting the race condition, and classified it as a potential denial-of-service issue. Remote code execution has not been publicly demonstrated on servers without an MPTCP listener, though the flaw also affects ordinary TCP connections.

MPTCP lets one connection use multiple network paths. Go 1.24 and later enables MPTCP by default for TCP listeners on Linux when the kernel supports it, so some Go services may use MPTCP without administrators knowing.

The upstream kernel fix has been backported to maintained branches, but updates are not available for every affected distribution. Canonical listed Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 as still vulnerable on October 30, with fixes in progress. Red Hat listed RHEL 8, 9, and 10 as affected; RHEL 7 is not affected. Debian fixes include kernel packages 6.1.190-1 for Debian 12 and 6.12.113-1 for Debian 13. There are no confirmed reports of exploitation in the wild.