Critical Linux kernel flaw allows remote root attacks on MPTCP servers

A critical use-after-free vulnerability in the Linux kernel, tracked as CVE-2026-98432, affects TCP connection handling and allows unauthenticated remote attackers to potentially execute code as root on systems with Multipath TCP (MPTCP) enabled. The flaw impacts Linux kernels from version 4.4 onward, including major distributions such as Ubuntu, RHEL, and Rocky Linux. While exploitation is complex, researchers at Anthropic demonstrated remote root code execution under specific conditions using an unreleased AI model. The vulnerability stems from a race condition in tcp_v4_syn_recv_sock() and can be triggered even without MPTCP in some cases, though exploitation has not been publicly demonstrated on standard TCP connections.

AI-extracted · verify before operational use