Anthropic researchers have shown that CVE-2026-98432, the critical flaw in the Linux kernel’s IPv4 TCP code, can be used for unauthenticated remote code execution as root on servers running a Multipath TCP (MPTCP) listener. The exploit, built by an unreleased Claude model, took about 53 minutes to reach remote root, according to the company’s report as covered by BleepingComputer on 30 October 2026.
Key facts about the CVE-2026-98432 MPTCP exploit in 30 seconds
- Anthropic researchers showed the bug allows unauthenticated remote root code execution on Linux servers with an MPTCP listener.
- It affects kernels back to 4.4, and Go 1.24 or later enables MPTCP by default on Linux TCP listeners.
- CIQ warns that disabling MPTCP is not enough, because plain TCP traffic can still trigger the flaw.
- Debian has already shipped patched kernels, while Ubuntu, RHEL and Rocky Linux fixes are still in progress.
SystemAdministration.net has already covered how to check and patch servers affected by CVE-2026-98432. What is new is proof that the bug is more than a way to crash a server. According to BleepingComputer, Anthropic’s exploit bypasses kernel address space layout randomization (KASLR) and runs arbitrary commands as root on a Linux server with an MPTCP listener. There are no confirmed reports of exploitation in the wild so far.
What the bug is and why there are two scores
CVE-2026-98432 is a use-after-free caused by a race condition in how the kernel handles TCP connection requests. Per the kernel advisory, tcp_v4_syn_recv_sock() hands ownership of the request’s IP options to the child socket without copying them, while another CPU may be processing a retransmitted SYN for the same request and sending a SYNACK. The memory can end up being freed twice. A similar issue can occur during request socket migration when net.ipv4.tcp_migrate_req is enabled or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is in use.
The Linux kernel CVE team rates it 9.8 out of 10. Red Hat treats it as a potential denial-of-service issue that could crash the kernel and scores it 5.9, because exploiting the race is more involved than sending one malicious packet. The Anthropic demonstration shows that, under specific conditions, the impact goes beyond a crash.
Watch out for Go services
MPTCP lets a single connection use several network paths at once, and most applications do not enable it by default. There is one notable exception: since Go 1.24, the language enables MPTCP by default for TCP listeners on Linux whenever the kernel supports it. That means some Go-based network services may be listening with MPTCP without the administrator knowing. It is worth auditing which Go binaries expose ports on your servers, since they match the remote code execution scenario that was demonstrated.
Even so, CIQ, the company behind Rocky Linux support, warns that turning off MPTCP alone is not enough, because the underlying flaw can also be triggered through ordinary TCP traffic, although remote code execution has not been publicly shown in that case.
Patch status and temporary mitigations
The bug is fixed upstream and in maintained stable branches, but not every distribution has shipped packages yet. According to BleepingComputer, as of 30 October:
- Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 remain vulnerable, with kernel fixes in progress.
- Red Hat Enterprise Linux 8, 9 and 10 are affected, with fixes planned; RHEL 7 is not, as its kernel lacks the vulnerable code.
- Rocky Linux 8, 9 and 10 are affected, according to CIQ.
- Debian has fixed it in kernel package 6.1.190-1 for Debian 12 and 6.12.113-1 for Debian 13, plus testing and unstable.
- Oracle Linux, Amazon Linux and SUSE have released fixes for some kernel versions.
Until patches land, the advice is to restrict access to trusted networks or IP addresses. CIQ also suggests temporarily dropping IPv4 TCP packets that carry IP options before they reach the vulnerable code, and has shared sample nftables rules for that. Once an updated kernel is available, install it and reboot so it is actually loaded.
Frequently asked questions
What is CVE-2026-98432?
A use-after-free bug in the Linux kernel’s IPv4 TCP code, rated 9.8 by the kernel CVE team, that affects kernels from version 4.4 onwards.
Can it be exploited remotely?
Yes, on servers with an MPTCP listener: Anthropic demonstrated an exploit that achieved remote root in about 53 minutes. There are no reports of in-the-wild exploitation.
Is disabling MPTCP enough?
No. According to CIQ, the flaw can also be triggered by ordinary TCP traffic, so the kernel must be updated.
Which distributions are already patched?
Debian 12 and 13, plus some Oracle Linux, Amazon Linux and SUSE kernels. Ubuntu, RHEL and Rocky Linux fixes are in progress.
Sources: