Critical Linux kernel TCP flaw draws remote root exploit demo
Anthropic researchers built an exploit for a use-after-free in IPv4 TCP handling that reached root on a server with an MPTCP listener. Patches are landing, but several major distros were still listed as vulnerable on October 30.
Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to run commands as root on servers running Multipath TCP (MPTCP) listeners, BleepingComputer reported on October 30, 2026.
The flaw, tracked as CVE-2026-98432, is a use-after-free in the kernel's IPv4 TCP networking code. The Linux kernel CVE team scored it 9.8 out of 10. It affects kernels dating back to version 4.4, including Ubuntu, Red Hat Enterprise Linux and Rocky Linux.
How the bug works
Per the kernel advisory, the kernel hands ownership of a request socket's IP options to the child socket without copying them. Another CPU can process a retransmitted SYN at the same time and build a SYNACK while the child is freed, so the options are read after release. A similar problem exists with request socket migration when net.ipv4.tcp_migrate_req is enabled or a BPF reuseport migration program is used. The fix moves the frees to kfree_rcu().
Disputed severity
Red Hat rates it 5.9, calling it a potential denial-of-service issue with complex exploitation. Anthropic says an unreleased Claude model bypassed KASLR and got remote root in about 53 minutes, though only against an MPTCP listener. Remote code execution has not been publicly shown on servers without one.
What defenders should do
MPTCP isn't usually on by default, but Go 1.24 and later enable it for TCP listeners on Linux where the kernel supports it, so some Go services may be listening without admins knowing. Disabling MPTCP alone isn't enough, since ordinary TCP traffic can still trigger the bug.
Check your distribution's advisories and install updated kernel packages. Debian 12 and 13 have fixed packages. Ubuntu, RHEL and Rocky Linux were still listed as affected with fixes pending. CIQ shared temporary nftables rules to block IPv4 TCP packets carrying IP options. There are no confirmed reports of exploitation in the wild.
CVE references
Sources
- Critical Linux kernel flaw allows remote root attacks on MPTCP serversPrimarywww.bleepingcomputer.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning