GoKawiilAnthropic researchers build exploit for critical Linux kernel MPTCP flaw CVE-2026-98432
Anthropic security researchers created a working exploit for CVE-2026-98432, a use-after-free bug in the Linux kernel's IPv4 TCP code rated 9.8/10 in severity. The flaw lets unauthenticated attackers achieve remote root code execution on servers running Multipath TCP listeners, and it also affects ordinary TCP connections across kernels back to version 4.4, including Ubuntu, RHEL and Rocky Linux, though RCE on non-MPTCP servers hasn't been publicly shown.
GoKawiil's interpretation of the reporting above, not reported fact.
A remotely triggerable, unauthenticated root exploit in widely deployed Linux distributions could pose serious risk to internet-facing servers once exploit details or working code spread further. Red Hat notes the race condition is harder to exploit than sending a single malicious packet, which may limit immediate mass exploitation, but the broad kernel version range affected suggests patching could take considerable time across enterprise and cloud infrastructure.
- CVE-2026-98432 is a 9.8-severity use-after-free bug in Linux's TCP networking code.
- It enables unauthenticated remote root execution on servers using Multipath TCP, and may affect regular TCP too.
- Affected kernels date back to version 4.4, covering major distros like Ubuntu, RHEL, and Rocky Linux.
Source: bleepingcomputer.com, 2026-10-30
Published there as: “Critical Linux kernel flaw allows remote root attacks on MPTCP servers”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.