CYBUNKR

Linux TCP flaw:remote root shown, exploit tooling now public

Published

CVE-2026-98432, a use-after-free in how the Linux kernel handles incoming IPv4 TCP connections, can be reached over the network without a login. Researchers showed remote root; Ubuntu and Red Hat fixes are still pending.

Most web servers, cloud servers and many appliances run Linux. CVE-2026-98432 is a flaw in the kernel code that handles every incoming IPv4 TCP connection: a race between two CPUs can make it use memory that has already been freed (CVE record). Ubuntu rates it 9.8 out of 10, priority High; Red Hat rates it Important, 8.1, because it sees the race as harder to win.

On 27 October Anthropic's research team described an exploit for it that lets a remote attacker run commands as root, with no credentials or user interaction, on Linux servers with a multipath TCP (MPTCP) listener (Anthropic).

Who is affected

  • Linux kernels from 4.4 without the fix. Fixed upstream in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3 (CVE record). IPv6 is not affected by the main issue.
  • Debian: fixed in bookworm (6.1.190-1, or linux-6.12 6.12.113-1~deb12u1) and trixie (6.12.113-1) (Debian).
  • Ubuntu: fixes for 22.04, 24.04, 26.04 and 26.10 are listed as pending, and 18.04 and 20.04 as needed (Ubuntu).
  • Red Hat Enterprise Linux 8, 9 and 10 are listed as affected, and Red Hat says no mitigation meets its criteria (Red Hat).
  • Programs written in Go: since Go 1.24 they turn on MPTCP for listening sockets on Linux by default, which matches the exploit's requirement (Go security team).

What has been seen so far

A snapshot from 30 October:

  • Anthropic says its proof of concept took 48 minutes to leak a kernel address and five more to run a command as root, and that a lost race only fails the connection, so an attacker can keep retrying (Anthropic).
  • Public tooling appeared on GitHub on 30 October with a race trigger and memory-leak check. Its author says it stops short of running code. The Go team warns that the bug is not specific to MPTCP and similar attacks may work without it (Go).
  • We found no report of exploitation in the wild, and it is not in CISA's Known Exploited Vulnerabilities catalog.

Unverified exploit code is sometimes laced with malware, so don't run it to test your own systems.

What to do

  • Install your distribution's kernel update and reboot as soon as it is available. The fix only works once the new kernel is running; check with uname -r.
  • Until then, turn off MPTCP where you don't use it: sysctl -w net.mptcp.enabled=0 stops new MPTCP sockets being created (kernel documentation), and GODEBUG=multipathtcp=0 does the same for a Go program (Go). This blocks the published route, not the bug itself.
  • Expose as little as possible: close ports that don't need to be public and limit admin services such as SSH to known IP addresses or a VPN.
  • If your hosting or servers are managed for you, ask your provider when the fixed kernel will be installed and running, and ask appliance vendors (firewalls, NAS, VPNs) whether their firmware is affected.

How we can help

If you think a server has been taken over, our Incident Response service can help, or get in touch.

Sources