Critical Linux kernel flaw allows remote root attacks on MPTCP servers

What happened?

Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners. [...]

Key details

• Anthropic researchers created an exploit achieving remote root code execution on Linux servers with MPTCP listeners.
• The vulnerability is a use-after-free in IPv4 TCP code caused by a race condition during connection handling.
• Linux kernels from version 4.4 onward are affected, including major distributions like Ubuntu, RHEL, and Rocky Linux.
• Go 1.24 enables MPTCP by default for TCP listeners on Linux, potentially exposing Go-based services unknowingly.
• Red Hat rates the flaw lower at 5.9 severity, viewing exploitation as complex and primarily a denial-of-service risk.
• Upstream kernel fixes exist and have been backported, but not all distributions have released updated packages yet.
• No confirmed in-the-wild exploitation of CVE-2026-98432 has been reported.

Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.