CriticalBreachCVE-2026-98432
Attackers Started Scanning in the Wild for Linux Kernel RCE Flaw, Ubuntu Releases Fixes
Cyber Security News·Source published ·1 min read
What happened?
Ubuntu has put early kernel fixes for CVE-2026-98432 in its -proposed pocket for 22.04 LTS and newer releases. The bug is a serious Linux kernel flaw that can let a remote user run commands as root without a login or any user action. The patches are still in testing, so many servers stay open for now. Canonical’s security team says the flaw sits in how the Linux kernel sets up IPv4 TCP connections, and it affects kernel versions 4.4 and later. The fixed builds are 5.15.0-203.213 for Jammy (22.04), 6.8.0-149.149 for Noble (24.04), and 7.0.0-43.43 for Resolute (26.04).
Key details
- Ubuntu released early kernel fixes for CVE-2026-98432 in its -proposed pocket for 22.04 LTS and newer releases.
- Anthropic's Frontier Red Team demonstrated an unreleased Claude model wrote a working exploit targeting Linux servers with MPTCP listeners after one prompt.
- No public remote code execution exploit exists yet, but several denial-of-service proofs-of-concept are available.
- Ubuntu states the flaw is not tied to MPTCP; the MPTCP link comes only from the Anthropic exploit, and updates are the only proper fix.
- Setting net.mptcp.enabled=0 does not close already-open MPTCP sockets; affected applications must restart.
Affected
- Linux kernel versions 4.4 and later are affected by CVE-2026-98432.
- Ubuntu Trusty (14.04) is not affected; Xenial (16.04), Bionic (18.04), and Focal (20.04) have fixes pending.
- Jammy (22.04 LTS), Noble (24.04 LTS), Resolute (26.04 LTS) have fixes in -proposed; Stonking (26.10) is already fixed.
What to look for
- Internet-wide scanning for MPTCP connections on port 443 from residential proxies and Russia-based VPN servers observed since November 2.
- Approximately 2.1 million servers reachable over MPTCP on port 443; deeper TLS scan found ~762,774.
- MPTCP listeners can be listed with 'sudo ss -Mlnp'.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.