Linux Kernel Exploit Enables Remote Root on MPTCP Hosts

A critical use-after-free vulnerability in the Linux kernel IPv4 TCP networking stack, tracked as CVE-2026-98432 with a 9.8 CVSS severity rating, allows unauthenticated remote attackers to execute arbitrary code with root privileges on servers hosting Multipath TCP (MPTCP) listeners. Researchers demonstrated that an exploit chain can bypass Kernel Address Space Layout Randomization (KASLR) and establish unauthenticated root command execution in approximately 53 minutes. While patches are entering enterprise distributions including Ubuntu, Red Hat Enterprise Linux, Debian, and Rocky Linux, administrators must apply kernel updates or deploy nftables packet filtering, as simply turning off MPTCP does not eliminate exposure in standard TCP traffic.

Kernel race condition enables remote root execution

The vulnerability traces back to Linux kernel version 4.4 and stems from a concurrency flaw in how the IPv4 networking subsystem processes TCP handshake requests. According to the upstream Linux kernel commit, the routine tcp_v4_syn_recv_sock() transfers ownership of IP request options (ireq->ireq_opt) to the child socket structure (newinet->inet_opt) without creating an independent copy.

When a multi-core server concurrently processes a retransmitted SYN packet for the same pending request socket, another CPU core can invoke tcp_check_req() and emit a SYNACK packet. During this sequence, functions such as tcp_v4_send_synack() and inet_csk_route_req() inspect ireq->ireq_opt protected solely by a Read-Copy-Update (RCU) read lock. Downstream helper routines, including ip_build_and_send_pkt() and ip_options_build(), subsequently read option lengths multiple times. If the child socket deallocates the shared memory region concurrently, a use-after-free condition occurs. A parallel race condition emerges during TCP request socket migration when administrators configure net.ipv4.tcp_migrate_req or leverage eBPF reuseport programs.

To permanently resolve the defect, upstream kernel maintainers adjusted memory cleanup routines to deallocate inet_opt and ireq_opt via kfree_rcu() rather than immediate calls to kfree(). This deferral ensures that memory structures persist until all concurrent RCU read-side critical sections finish execution.

AI-developed exploit chain bypasses KASLR

Security researchers at Anthropic demonstrated that CVE-2026-98432 represents more than a local denial-of-service vector. In a technical evaluation detailed in Anthropic’s research report, an internal Claude research model engineered a reliable remote exploit against an unauthenticated target running an MPTCP listener.

The exploit chain operated across two distinct phases. First, the automated model spent roughly 48 minutes grooming kernel memory and triggering subtle socket state discrepancies to leak an internal kernel pointer, successfully neutralizing KASLR remotely without crashing the host. Once the address layout was mapped, the model took an additional five minutes to overwrite kernel callback pointers, achieving unauthenticated remote code execution with root privileges. Similar to modern cloud isolation bypass exploit chains, this weaponization highlights how subtle kernel memory flaws can be strung together into reliable control compromises.

While Multipath TCP is often considered a specialized protocol intended to bond cellular and Wi-Fi interfaces, its footprint in server environments has expanded unexpectedly. Beginning with Go 1.24, the runtime automatically enables MPTCP support on Linux TCP listeners whenever the underlying host kernel supports the feature. Consequently, many containerized microservices and backend network proxies written in Go now listen on MPTCP sockets by default, exposing organizations to this attack surface without explicit administrative intent.

Distribution patch status and firewall mitigations

Operating system vendors have published varied assessments and timelines based on package architectures. Debian released patched kernel packages under security advisories DLA-4841-1 and DSA-6568-1, updating Debian 12 (Bookworm) to version 6.1.190-1 and Debian 13 (Trixie) to version 6.12.113-1, with additional packages deployed to testing and unstable repositories.

Conversely, Canonical documented CVE-2026-98432 with a 9.8 CVSS score across Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10, indicating that distribution-wide patches remain in active development. Red Hat marked the flaw as Critical across Red Hat Enterprise Linux 8, 9, and 10 because TCP listening endpoints are exposed across network boundaries by default. Red Hat Enterprise Linux 7 remains unaffected because its legacy kernel baseline lacks the vulnerable socket-handling logic.

Infrastructure support provider CIQ released emergency defensive guidance for systems awaiting distribution packages. Critically, CIQ warned that toggling the sysctl setting net.mptcp.enabled=0 does not prevent exploitation, because the flawed use-after-free logic resides within the core IPv4 TCP stack and can be reached via standard TCP flows. Instead, CIQ recommends filtering option-bearing IPv4 TCP packets at the perimeter or host firewall using nftables rules before traffic reaches the kernel’s connection state machine. Systems running macOS remain completely unaffected, as Darwin relies on Apple’s proprietary XNU kernel rather than the Linux networking subsystem. As of October 30, 2026, security analysts have observed no active exploitation in the wild.

What happens next

Enterprise security teams should immediately inventory production Linux hosts to identify exposed network services, paying particular attention to Go 1.24 compiled binaries and environments with active MPTCP configurations. For unpatched distributions, administrators should restrict perimeter access using nftables rules to drop inbound IPv4 TCP packets carrying IP options, or constrain ingress traffic to trusted corporate CIDR blocks.

Linux distribution vendors are expected to roll out updated kernel packages over the coming days. System administrators must monitor distribution security advisories, stage kernel updates in non-production environments to verify network stability, and schedule reboots to ensure memory resident kernels are replaced. Engineering organizations should also review eBPF socket reuse programs and TCP socket migration policies to ensure secondary race conditions are identified and remediated across heterogeneous infrastructure.