Linux Kernel Flaw CVE-2026-98432: Patch MPTCP Servers

Short answer: CVE-2026-98432 is a use-after-free bug (a memory error) in the Linux kernel's IPv4 TCP code. Researchers at Anthropic built an exploit that gave remote root access on a server with an MPTCP listener. There are no confirmed attacks yet. Check your distribution's advisory and install the updated kernel as soon as it is available, then reboot.

The key facts

The two scores differ because Red Hat judges that winning the race is harder than sending one bad packet, and rates it as a likely crash (denial of service). Anthropic's demonstration shows more is possible under the right conditions. According to BleepingComputer, an unreleased Claude model built an exploit that bypassed KASLR (a memory randomisation defense) and ran commands as root in about 53 minutes.

Step 1: find out whether you are affected

Run uname -r to see your kernel version. Almost any maintained distribution is in scope. Red Hat says RHEL 8, 9 and 10 are affected while RHEL 7 is not. Rocky Linux 8, 9 and 10 are affected. Ubuntu 22.04, 24.04, 26.04 and 26.10 were still vulnerable as of October 30.

Step 2: check for hidden MPTCP listeners

MPTCP (Multipath TCP) lets one connection use several network paths. Since Go 1.24, Go enables MPTCP by default for TCP listeners on Linux when the kernel supports it. A Go service may therefore have an MPTCP listener you never turned on. Ask your developers which services are written in Go and which ports they expose to the internet.

Step 3: install the kernel update

Use your distribution's tracker and package manager. Debian 12 (Bookworm) has kernel 6.1.190-1 and Debian 13 (Trixie) has 6.12.113-1. Oracle Linux, Amazon Linux and SUSE have released fixes for some kernels. For Ubuntu, RHEL and Rocky, watch the vendor pages linked in the sources.

sudo apt update && sudo apt upgrade     # Debian, Ubuntu
sudo dnf upgrade kernel                 # RHEL, Rocky
sudo reboot

A kernel update does nothing until you reboot into it. Confirm with uname -r afterwards.

Step 4: reduce exposure while you wait

If no patch exists yet for your distribution:

• limit access to trusted networks or IP addresses with your firewall
• consider CIQ's suggestion to temporarily block IPv4 TCP packets that carry IP options before they reach the kernel (CIQ has published nftables examples)
• do not rely on turning MPTCP off alone

Common mistakes

• Installing the kernel package and forgetting to reboot.
• Assuming "no MPTCP" means "not affected". Regular TCP is also affected.
• Waiting for exploitation reports before acting on a root-level flaw.
• Forgetting containers and VMs: they share the host kernel or have their own.
• Skipping patching the rest of the stack while the kernel is in the news.