Clarissa Hana
Security researchers at Anthropic have uncovered a critical vulnerability within the Linux kernel, designated CVE-2026-98432, which, under specific conditions, permits unauthenticated attackers to achieve remote command execution with root privileges on affected servers. The exploit’s efficacy is amplified when Multipath TCP (MPTCP) listeners are active, a feature increasingly adopted by modern applications and programming languages. While the immediate threat is elevated by MPTCP, the underlying flaw also impacts standard TCP connections, raising concerns across a broad spectrum of Linux-based systems.
The vulnerability, a use-after-free flaw residing within the kernel’s IPv4 TCP networking code, has been assigned a severe CVSS score of 9.8 out of 10 by the Linux kernel CVE team, underscoring its significant potential for exploitation. This critical flaw has been traced back to Linux kernel version 4.4 and affects a wide array of widely deployed Linux distributions, including Ubuntu, Red Hat Enterprise Linux (RHEL), and Rocky Linux, creating a substantial attack surface.
Background and Technical Details of CVE-2026-98432
At its core, CVE-2026-98432 is a race condition that arises during the handling of TCP connection requests within the Linux kernel. The Linux kernel advisory details a complex interaction within the tcp_v4_syn_recv_sock() function. Specifically, the ownership of ireq->ireq_opt is transferred to a child socket (newinet->inet_opt) without a proper copy operation. This can lead to a situation where another CPU, concurrently processing a retransmitted SYN packet for the same request socket, initiates a SYN-ACK response.
During this concurrent processing, functions like tcp_v4_send_synack() and inet_csk_route_req() access ireq->ireq_opt under an RCU (Read-Copy-Update) read lock. Subsequently, ip_build_and_send_pkt() and ip_options_build() read opt->optlen twice. This sequence of events can result in a use-after-free condition, where a piece of memory is accessed after it has been deallocated, leading to unpredictable behavior and potential security compromises. A similar vulnerability can be triggered during TCP request socket migration when the net.ipv4.tcp_migrate_req sysctl is enabled, or when a BPF (Berkeley Packet Filter) program utilizing BPF_SK_REUSEPORT_SELECT_OR_MIGRATE is in effect.
Anthropic’s Discovery and Demonstration of Exploitation
The severity of CVE-2026-98432 was brought to light by security researchers at Anthropic. Leveraging an advanced, unreleased Claude AI model, they successfully developed an exploit capable of bypassing Kernel Address Space Layout Randomization (KASLR), a critical security mechanism designed to thwart memory-based attacks. The exploit allowed for the arbitrary execution of commands as a root user on a Linux server that was configured with an active MPTCP listener.
While the initial discovery and technical analysis indicated a potential for denial-of-service (DoS) attacks, Anthropic’s demonstration proved that the vulnerability could be weaponized for more profound remote code execution. Their research indicates that achieving remote root code execution via this exploit took approximately 53 minutes. This duration, while not instantaneous, is significant enough to be a practical concern for attackers seeking persistent access or to deploy malicious payloads.
The role of Multipath TCP (MPTCP) in Amplifying the Threat
Multipath TCP (MPTCP) is a sophisticated extension to the standard TCP protocol that enables a single connection to utilize multiple network paths simultaneously. This feature is designed to enhance network performance and resilience, particularly in environments where devices possess multiple network interfaces, such as smartphones leveraging both Wi-Fi and cellular data.
While MPTCP is not universally enabled by default across all applications, its adoption is growing. A notable development is its inclusion in the Go programming language. Starting with Go version 1.24, MPTCP is enabled by default for TCP listeners on Linux systems, provided the underlying kernel supports the feature. This means that a significant number of Go-based network services could be unknowingly exposing their listeners to this vulnerability if administrators are not actively managing MPTCP configurations. The implications of this default enablement are substantial, as it broadens the potential attack surface without explicit user configuration in many cases.
Red Hat’s Assessment and Mitigation Efforts
Red Hat, a major provider of Linux enterprise solutions, has also provided its analysis of CVE-2026-98432. While acknowledging the vulnerability, Red Hat has classified it as a potential denial-of-service issue, capable of inducing kernel crashes. They have assigned a lower severity score of 5.9 to the vulnerability, citing the complexity involved in exploiting the race condition. According to Red Hat’s security advisory, successfully triggering the vulnerability requires more than simply sending a malformed network packet; it involves a nuanced manipulation of network conditions.
Despite this assessment, Anthropic’s research clearly demonstrates that remote code execution is achievable under specific circumstances, particularly with an active MPTCP listener. This divergence in severity assessment highlights the importance of considering different exploitation scenarios and threat models.
Timeline and Patching Status
The vulnerability was initially addressed in the upstream Linux kernel, and subsequently, patches have been backported to various maintained kernel branches. However, the dissemination of these security updates across all affected Linux distributions is an ongoing process.
As of October 30th, Canonical’s security tracker indicates that Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 remain vulnerable, with kernel fixes in progress. Red Hat has listed RHEL 8, 9, and 10 as affected, with planned updates to address the flaw. Notably, RHEL 7 is not impacted because its kernel version predates the vulnerable code introduction.
Rocky Linux, supported by CIQ, has also confirmed that Rocky Linux 8, 9, and 10 are susceptible. CIQ has provided temporary firewall mitigation guidance for affected systems, emphasizing the need for immediate protective measures.
Debian has been more proactive in patching. According to Debian’s security tracker, the vulnerability was resolved in kernel package version 6.1.190-1 for Debian 12 (Bookworm) and 6.12.113-1 for Debian 13 (Trixie). Fixed packages are also available for Debian’s testing and unstable branches.
Other prominent Linux vendors, including Oracle Linux, Amazon Linux, and SUSE, have also released security updates for some of their affected kernel versions.
Broader Impact and Mitigation Strategies
The implications of CVE-2026-98432 extend beyond specific distributions. The fact that the vulnerability resides in the core Linux kernel means that any system running an affected kernel version is potentially at risk. While macOS is not affected due to its use of Apple’s XNU kernel, the vast ecosystem of Linux servers, cloud infrastructure, and embedded devices presents a significant target.
System administrators are strongly advised to monitor their respective distribution’s security advisories closely and to deploy updated kernel packages as soon as they become available. Proactive patching is the most effective defense against this critical vulnerability.
For systems where immediate patching is not feasible, several mitigation strategies can be employed. Restricting network access to trusted IP addresses or networks can significantly reduce the attack surface. CIQ has also recommended temporarily blocking IPv4 TCP packets containing IP options before they reach the vulnerable TCP processing code. They have provided examples of nftables rules that can be implemented to filter this type of malicious traffic.
It is crucial to understand that simply disabling MPTCP is not a complete solution. The underlying vulnerability can still be triggered through ordinary TCP traffic, making comprehensive patching essential.
Current Threat Landscape and Future Concerns
As of the latest reports, there are no confirmed instances of CVE-2026-98432 being actively exploited in the wild. However, the existence of a publicly disclosed exploit, coupled with the vulnerability’s high severity and broad impact, creates a fertile ground for future attacks. The time lag between vulnerability disclosure and widespread patching often provides a window of opportunity for malicious actors.
The role of AI in vulnerability discovery, as demonstrated by Anthropic’s use of Claude, also signifies a new frontier in cybersecurity. AI models can potentially accelerate the identification of complex flaws that might otherwise remain undetected for extended periods. This dual-edged sword necessitates a continuous evolution of defensive strategies and a proactive approach to security.
The exploitation of CVE-2026-98432, especially its potential for remote code execution with root privileges, underscores the persistent need for robust security practices, including regular vulnerability scanning, timely patching, and defense-in-depth strategies. The interconnected nature of modern IT infrastructure means that a single critical vulnerability can have cascading effects, highlighting the importance of vigilance and rapid response from both vendors and end-users. The ongoing efforts to patch this vulnerability are a testament to the collaborative nature of the cybersecurity community in addressing threats to the global digital infrastructure.
