Critical Linux kernel flaw allows remote root attacks on MPTCP servers

Anthropic security researchers have built a working exploit for a critical Linux kernel vulnerability that lets unauthenticated attackers run commands as root on servers with Multipath TCP (MPTCP) listeners, BleepingComputer reported. The flaw, tracked as CVE-2026-98432, also affects ordinary TCP connections, though remote code execution has not been publicly shown against servers without an MPTCP listener.

MPTCP is a TCP feature that lets one connection use multiple network paths simultaneously to improve performance and reliability. It is common where devices hold several network connections, such as Wi-Fi and cellular. The vulnerability is a use-after-free in the kernel's IPv4 TCP networking code and received a severity score of 9.8 out of 10 from the Linux kernel CVE team.

Linux kernels going back to version 4.4 are affected, including Ubuntu, Red Hat Enterprise Linux (RHEL), and Rocky Linux. A kernel advisory traces the flaw to a race condition in handling TCP connection requests: one CPU can process a retransmitted SYN for the same request socket while another sends a SYNACK, and the advisory describes ownership of ireq->ireq_opt being transferred without copying. A similar issue can arise during TCP request socket migration when net.ipv4.tcp_migrate_req is enabled or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is used.

No authentication is needed to trigger the flaw, but Red Hat says exploiting the race is more complex than sending a malicious packet. Red Hat rates it a potential denial-of-service issue that could crash the kernel and assigns a lower score of 5.9 because exploitation is complex. Anthropic researchers showed remote code execution is possible under specific conditions: an unreleased Claude AI model produced an exploit that bypassed kernel address space layout randomization (KASLR) and executed arbitrary commands as root on a Linux server running an MPTCP listener, according to an Anthropic report. Anthropic said the exploit took about 53 minutes to achieve remote root code execution.

MPTCP is not typically on by default in applications, but some software enables it automatically. Since Go 1.24, the language turns on MPTCP by default for TCP listeners on Linux when the kernel supports it, so some Go-based network services may run MPTCP listeners without administrators knowing. The flaw is fixed in the upstream Linux kernel and backported to maintained branches, but updates have not reached all affected distributions.

Canonical's security tracker lists Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 as vulnerable with kernel fixes in progress as of October 30. Red Hat lists RHEL 8, 9, and 10 as affected with fixes planned; RHEL 7 is not affected because its kernel lacks the vulnerable code. CIQ, which provides Rocky Linux support, confirmed Rocky Linux 8, 9, and 10 are affected and shared temporary firewall protections. Debian fixed the flaw in kernel package 6.1.190-1 for Debian 12 (Bookworm) and 6.12.113-1 for Debian 13 (Trixie), with fixed packages also available for testing and unstable, and Oracle Linux, Amazon Linux, and SUSE have released fixes for some kernel versions. macOS is unaffected because it uses Apple's XNU kernel rather than the Linux kernel, and administrators are advised to check their distribution's advisories and install updated kernel packages as they become available.

More cybersecurity news from TechManNews.