A critical security vulnerability in the Linux kernel could allow attackers to remotely take control of vulnerable servers and execute commands with root privileges. Security researchers at Anthropic have developed an exploit demonstrating how the flaw can be used to compromise Linux systems running Multipath TCP (MPTCP) listeners.
.webp){kind=link}
The vulnerability, tracked as CVE-2026-98432, has received a critical severity rating of 9.8 out of 10 from the Linux kernel CVE team. It affects Linux kernel versions dating back to 4.4 and could put several widely used Linux distributions at risk.
About the problem
The security issue is caused by a use-after-free vulnerability in the Linux kernel’s IPv4 TCP networking code. It occurs because of a race condition during the handling of TCP connection requests.
The vulnerability affects both regular TCP connections and Multipath TCP (MPTCP). MPTCP allows a single network connection to use multiple network paths simultaneously, improving connection reliability and performance.
Researchers at Anthropic demonstrated that the flaw could be exploited remotely without authentication on servers running MPTCP listeners. Their exploit was developed using an unreleased Claude AI model and reportedly took around 53 minutes to achieve remote code execution with root privileges.
The exploit also managed to bypass Kernel Address Space Layout Randomization (KASLR), a security mechanism designed to make memory-based attacks more difficult.
Another concern involves Go 1.24, which enables MPTCP by default for TCP listeners on Linux when the underlying kernel supports the feature. This means some Go-based applications could expose vulnerable services without administrators being aware of it.
Who is impacted?
The vulnerability affects multiple Linux distributions, including Ubuntu, Red Hat Enterprise Linux (RHEL) and Rocky Linux. While the Linux kernel issue can also be triggered through ordinary TCP connections, publicly demonstrated remote root exploitation has so far focused on systems running MPTCP listeners.
Red Hat has assessed the vulnerability as a complex exploitation risk that could result in a denial-of-service condition, assigning it a lower severity score of 5.9.
How to address
The vulnerability has been fixed in the upstream Linux kernel, with patches also backported to maintained kernel branches. However, security updates were still pending for several distributions as of October 30, 2026.
Rocky Linux support provider CIQ has also recommended temporary firewall protections using nftables to block IPv4 TCP packets containing IP options. But simply disabling MPTCP is not sufficient because the underlying vulnerability can also be triggered through ordinary TCP traffic.
There are currently no confirmed reports of CVE-2026-98432 being exploited in real-world attacks.
Read the original article:
Critical Linux Kernel Vulnerability Could Allow Hackers to Gain Remote Root Access