Linux kernel TCP flaw CVE-2026-98432 allows remote root on MPTCP servers
Original title: Critical Linux kernel flaw allows remote root attacks on MPTCP servers
Anthropic says an unreleased Claude model built a root exploit in about 53 minutes; no in-the-wild attacks are confirmed.
CVE-2026-98432 is a use-after-free from a race in the Linux kernel's IPv4 TCP code, scored 9.8 by the kernel CVE team and present since kernel 4.4. Unauthenticated attackers can reach it on TCP listeners; Anthropic showed remote root only on servers with an MPTCP listener. Red Hat rates it 5.9 as a complex denial-of-service risk. Upstream and some distros have fixes, but Ubuntu and RHEL updates were still pending as of October 30.
Unconfirmed: Red Hat scores it 5.9 as complex denial of service, while Anthropic demonstrated root RCE only under specific MPTCP conditions.
- Ordinary TCP can trigger the bug, but public RCE was shown only with MPTCP.
- Go 1.24 enables MPTCP by default for Linux TCP listeners when the kernel supports it.
- Debian fixed it in 6.1.190-1 (Bookworm) and 6.12.113-1 (Trixie).
- Ubuntu 22.04, 24.04, 26.04 LTS and 26.10 were still vulnerable on October 30.
- RHEL 8, 9 and 10 and Rocky Linux 8, 9 and 10 are affected; RHEL 7 is not.
Impact: Remote root command execution, or a kernel crash
| Product | Affected | Fixed in |
|---|---|---|
| Linux kernel | since version 4.4 | upstream and maintained branches; not all distros yet |
| Canonical Ubuntu | 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 | — |
| Red Hat Enterprise Linux | RHEL 8, 9, and 10 | — |
| CIQ Rocky Linux | 8, 9, and 10 | — |
| Debian kernel | Debian 12 and 13 before the fixed packages | 6.1.190-1 (Bookworm); 6.12.113-1 (Trixie) |
- 1.Install distribution kernel updates as they are published.
- 2.Until patched, restrict TCP access to trusted networks or addresses.
- 3.CIQ suggests nftables rules blocking IPv4 TCP packets that contain IP options.
- CVEs
- CVE-2026-98432
- AI models
- Claude
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-98432 | Use-after-free in Linux kernel IPv4 TCP options | 9.8 | <1% | PoC ×17 |
From the original article
3 min read at bleepingcomputer.com
Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.