A critical Linux kernel vulnerability, CVE-2026-98432 (CVSS 9.8), can let an unauthenticated remote attacker gain root on servers that run a Multipath TCP (MPTCP) listener. The bug is a use-after-free race in the kernel’s IPv4 TCP connection setup code and has been present since Linux 4.4. Anthropic researchers demonstrated the issue, with an unreleased Claude model building a working exploit that achieved root in about 53 minutes.
What’s affected
- Ubuntu, including its cloud, FIPS and real-time kernels
- RHEL 8, 9 and 10, OpenShift 4, Rocky Linux and other distributions
- AlmaLinux follows RHEL and is expected to be affected, though its errata page has not yet confirmed this
The remote attack requires an MPTCP listener. Go 1.24 and later enables MPTCP by default for TCP listeners on Linux, so Go-based services, including much of today’s container tooling, are the main concern. IPv6 is not affected. Red Hat rates the flaw 5.9, citing the difficulty of winning the race and treating it mainly as a crash risk.
Exploitation status
There are no reports of exploitation in the wild, and the flaw is not in CISA’s Known Exploited Vulnerabilities catalog. It is unconfirmed whether the demonstrated exploit has been released publicly.
What to do
The fix has been backported to all stable upstream kernels, and Debian, SUSE, Oracle Linux and Amazon Linux have shipped updates. At the time of writing, Ubuntu’s tracker still lists its kernels as vulnerable or in progress, and Red Hat has not given a release date.
- Install the kernel update as soon as your distribution publishes it, and reboot.
- Until then, inventory exposed services that listen with MPTCP, especially Go binaries.
- Where MPTCP isn’t needed, consider disabling it with
sysctl -w net.mptcp.enabled=0(a general hardening step, not official vendor guidance).
