Cybersecurity

Critical Linux Kernel Flaw Allows Remote Root Attacks

Security researchers have developed an exploit for a critical Linux kernel vulnerability impacting multiple major distributions, though no in-the-wild exploitation has been confirmed.

Radwan AbdulhadiEditor and technology writer

Published: October 31, 2026 · Updated: October 31, 2026 · 3 min read

Critical Linux Kernel Flaw Allows Remote Root Attacks — Image: BleepingComputer

Critical Flaw in Linux Kernel Networking Code

Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. Tracked as CVE-2026-98432, the vulnerability is a use-after-free issue residing in the kernel's IPv4 TCP networking code and received a severity score of 9.8 out of 10 from the Linux kernel CVE team.

The vulnerability affects Linux kernels dating back to version 4.4, including widely deployed enterprise and community distributions such as Ubuntu, Red Hat Enterprise Linux (RHEL), and Rocky Linux. According to the Linux kernel advisory, the root cause is a race condition tied to how the kernel handles TCP connection requests during option transfers and retransmissions.

AI-Assisted Exploit Development and Remote Code Execution

While Multipath TCP is designed to let a single connection utilize multiple network paths simultaneously—such as Wi-Fi and cellular networks—it introduces a significant attack vector when configured with active listeners. An Anthropic report detailed how an unreleased Claude AI model successfully constructed an exploit that bypassed kernel address space layout randomization (KASLR) to execute arbitrary commands as root.

The AI-driven exploit achieved remote root code execution in approximately 53 minutes. Although Red Hat initially classified the vulnerability as a denial-of-service issue with a lower severity score of 5.9 due to the complexity of racing the condition, Anthropic's demonstration confirmed that full system compromise is possible under specific conditions.

Unintentional Exposure Through Go Programming Language

Although MPTCP is not universally enabled by default across all applications, certain software configurations activate it automatically. Beginning with Go 1.24, the programming language enables MPTCP by default for TCP listeners on Linux systems provided the underlying kernel supports the feature. Consequently, administrators may run Go-based network services with active MPTCP listeners without realizing it.

Vendor Responses and Mitigation Strategies

Linux vendors and maintainers have begun releasing patches across various distributions. Canonical's security tracker notes that Ubuntu versions 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 remain vulnerable while kernel fixes are actively prepared. Meanwhile, Debian's security tracker confirms that fixes have landed in kernel package version 6.1.190-1 for Debian 12 (Bookworm) and 6.12.113-1 for Debian 13 (Trixie).

For environments awaiting official kernel updates, mitigation guidance from Rocky Linux support provider CIQ outlines temporary firewall protections. Because disabling MPTCP alone does not eliminate the risk—since the underlying vulnerability can also be triggered via standard TCP traffic—administrators are advised to apply temporary packet-filtering rules, restrict access to trusted networks, or deploy updated kernel packages as soon as they become available.