Cybersecurity

Linux Kernel Exploit Enables Remote Root Attacks on MPTCP

An unreleased Claude AI model developed a working exploit for a critical Linux kernel vulnerability, highlighting severe risks for servers running Multipath TCP listeners.

Radwan AbdulhadiEditor and technology writer

Published: October 31, 2026 · Updated: October 31, 2026 · 4 min read

Linux Kernel Exploit Enables Remote Root Attacks on MPTCP — Image: BleepingComputer

Critical Linux Kernel Vulnerability Disclosed

Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. Detailed extensively in the official [Anthropic report](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude), the flaw is tracked as [CVE-2026-98432](https://nvd.nist.gov/vuln/detail/cve-2026-98432).

Multipath TCP is a networking feature designed to let a single connection utilize multiple network paths simultaneously, such as Wi-Fi and cellular networks, to boost performance and reliability. According to the [Linux kernel advisory](https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox), the vulnerability stems from a race condition in the kernel's IPv4 TCP networking code.

The vulnerability affects Linux kernel versions dating all the way back to version 4.4. This wide-ranging scope impacts multiple widely used enterprise and community distributions, including Ubuntu, Red Hat Enterprise Linux, and Rocky Linux.

Technical Mechanics of the Race Condition

The underlying security flaw manifests as a use-after-free condition within the kernel's IPv4 TCP subsystem. The Linux kernel CVE team assigned the vulnerability a severe base score of 9.8 out of 10. A similar issue can also occur during TCP request socket migration whenever net.ipv4.tcp_migrate_req is enabled or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is utilized.

Although triggering the race condition requires no authentication, vendors and researchers note that successful exploitation involves complex conditions. As outlined in documentation by [Red Hat says exploiting](https://access.redhat.com/security/cve/cve-2026-98432) the vulnerability is complex, leading Red Hat to classify it primarily as a potential denial-of-service vector causing kernel crashes with a base score of 5.9.

Despite the classification challenges, Anthropic researchers proved that remote code execution is entirely possible under specific parameters. An unreleased version of the Claude AI model successfully generated an exploit that bypassed kernel address space layout randomization, executing arbitrary root commands on a server running an MPTCP listener within approximately 53 minutes.

Impact on Go Applications and Default Settings

While Multipath TCP is not typically enabled by default in standard server software applications, certain runtimes and environments turn it on automatically without direct administrator awareness. For instance, beginning with Go 1.24, the programming language [enables MPTCP by default](https://go.dev/doc/godebug#go-124) for TCP listeners on Linux systems as long as the underlying kernel supports the capability.

This automated activation means that many Go-based network services might expose MPTCP listeners to potential network traffic without system operators realizing the feature is active. Furthermore, experts emphasize that simply disabling MPTCP is insufficient to eliminate exposure entirely, because the underlying flaw can still be triggered via ordinary TCP traffic under certain conditions.

Vendor Advisories and Affected Distributions

Major Linux maintainers and distribution vendors have rushed to release security advisories and updated packages. According to [Canonical's security tracker](https://ubuntu.com/security/CVE-2026-98432), Ubuntu releases including versions 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 remain vulnerable while kernel fixes are actively developed and rolled out.

Red Hat has confirmed that Red Hat Enterprise Linux versions 8, 9, and 10 are affected, with patches planned for subsequent updates, whereas RHEL 7 remains [not affected](https://access.redhat.com/security/cve/cve-2026-98432) due to its older kernel codebase lacking the vulnerable code.

Additional tracking information is available through [Debian's security tracker](https://security-tracker.debian.org/tracker/CVE-2026-98432), which indicates that fixes arrived in kernel package version 6.1.190-1 for Debian 12 (Bookworm) and version 6.12.113-1 for Debian 13 (Trixie). Other vendors such as Oracle Linux, Amazon Linux, and SUSE have also issued respective patches.

Mitigation Guidance and Recommendations

System administrators are strongly encouraged to monitor vendor bulletins and apply updated kernel packages immediately. For environments where immediate patching is impractical, temporary safeguards can significantly reduce exposure. Detailed [mitigation guidance](https://kb.ciq.com/article/security-advisories/cve-2026-98432-mitigation) provided by Rocky Linux support provider CIQ outlines alternative protective measures.

CIQ recommends restricting network access to trusted IP addresses and temporarily blocking incoming IPv4 TCP packets that contain specific IP options before they reach vulnerable protocol processing routines. The organization shared specific nftables rule configurations designed to filter out this hazardous traffic.

At the time of disclosure, security analysts report no confirmed instances of CVE-2026-98432 being actively exploited in the wild by malicious actors. Administrators operating non-Linux systems, such as macOS which relies on Apple's XNU kernel architecture, face no exposure to this vulnerability.