Linux TCP Flaw Allows Remote Root on MPTCP Listeners

The Linux kernel has fixed CVE-2026-98432, a use-after-free in IPv4 TCP connection handling. Anthropic reports that its researchers demonstrated unauthenticated remote command execution as root against a server with a Multipath TCP (MPTCP) listener. That is a demonstrated research result, not a report of attacks in the wild.

The Linux CVE record describes a race in which one kernel operation can free TCP socket options while another still reads them. The Linux kernel CVE team assigned CVSS 3.1 9.8 (Critical). The record lists fixes in the upstream and maintained stable branches. Anthropic also says the fix was backported to all maintained stable kernel branches. A fixed upstream branch does not mean every distribution kernel has shipped its update.

Where the risk stands

Anthropic’s demonstrated root execution requires an MPTCP listener. The underlying IPv4 TCP flaw is broader than MPTCP: the Go Security Team warns that systems without MPTCP listeners may still be vulnerable to other attacks. It also says Go 1.24 and later enable MPTCP by default for Linux listening sockets. That default can be changed, but the team calls a patched kernel the best fix.

Vendor assessments and update availability differ:

• Red Hat’s October 30 bulletin rates the issue Critical, identifies RHEL 8, 9 and 10 and OpenShift as affected, and says fixes are being expedited. Its CVE page currently lists a preliminary CVSS 3.1 score of 9.8.
• Ubuntu’s tracker marks the main linux packages in 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS as vulnerable with fixes in progress. It gives the issue High priority while displaying the 9.8 CVSS 3.1 score.
• Debian’s tracker lists fixed security packages for bookworm and trixie, as well as fixed versions in forky and sid. Check the installed kernel against the tracker; a fixed package in a repository does not mean a machine has installed and booted it.
• CIQ said on October 30 that it had not yet published patched kernels for the RLC Pro variants it checked. Its page points Rocky Linux community users to Rocky errata for their own package status.

What administrators should do

Check the running kernel and the advisory for its distribution, install the vendor’s fixed kernel when available, and reboot into it. Red Hat and CIQ describe interim traffic filtering for systems awaiting an update; follow their own guidance and test the effect on legitimate traffic. Disabling MPTCP alone does not remove the underlying IPv4 TCP flaw, as the Go Security Team and CIQ both caution.

Patch status is moving quickly. Use the linked vendor trackers for the exact package and release you run rather than treating a generic upstream version as proof that a distribution build is fixed.