Critical Linux Kernel Flaw CVE-2026-98432 Allows Remote Root Attacks on MPTCP Servers

Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability, tracked as CVE-2026-98432, which allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. The vulnerability is a use-after-free issue in the kernel's IPv4 TCP networking code, stemming from a race condition in how the kernel handles TCP connection requests.

Vulnerability Details and Severity

The Linux kernel CVE team assigned the flaw a severity score of 9.8 out of 10. The bug affects Linux kernels dating back to version 4.4, including widely used distributions such as Ubuntu, Red Hat Enterprise Linux (RHEL), and Rocky Linux. While the vulnerability affects ordinary TCP connections, public remote code execution has currently only been demonstrated on servers running an MPTCP listener.

Anthropic reported that an unreleased Claude AI model successfully developed an exploit bypassing kernel address space layout randomization (KASLR) to execute arbitrary commands as root in approximately 53 minutes. In contrast, Red Hat classifies the flaw as a potential denial-of-service issue with a lower severity score of 5.9, noting that exploiting the race condition involves significant complexity.

Impact on Ecosystems and Go Services

Although MPTCP is not always enabled by default across all applications, certain software configurations activate it automatically. For instance, beginning with Go 1.24, the programming language enables MPTCP by default for TCP listeners on Linux if supported by the kernel, potentially leaving some Go-based network services with active MPTCP listeners without explicit administrator awareness.

Patch Status and Mitigation Guidance

Upstream fixes have been released and backported to maintained branches, though rollout status varies across distributions:

• Ubuntu: Versions 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 remain vulnerable with kernel fixes in progress.
• Red Hat: RHEL 8, 9, and 10 are listed as affected with updates planned; RHEL 7 is unaffected.
• Debian: Fixes are available in kernel package version 6.1.190-1 for Debian 12 and 6.12.113-1 for Debian 13.
• Rocky Linux & Others: CIQ confirmed Rocky Linux 8, 9, and 10 are affected, while vendors like Oracle Linux, Amazon Linux, and SUSE have released patches for specific versions.

Administrators should check vendor security advisories and apply available kernel updates. For unpatched systems, mitigation options include restricting access to trusted networks, using temporary firewall protections such as nftables rules to block IPv4 TCP packets containing IP options, and noting that disabling MPTCP alone does not fully prevent exploitation via ordinary TCP traffic. There are currently no confirmed reports of CVE-2026-98432 being actively exploited in the wild.