Critical Linux kernel flaw allows remote root attacks on MPTCP servers

Summary

Anthropic researchers built an exploit for CVE-2026-98432, a use-after-free flaw in the Linux kernel's IPv4 TCP networking code that Linux kernel CVE team scored 9.8 out of 10. Unauthenticated attackers could execute commands as root remotely on servers running MPTCP listeners, and the flaw affects kernels back to version 4.4. The source states that Anthropic's exploit took about 53 minutes to achieve remote root code execution.

Mitigation

The vulnerability was fixed in the upstream Linux kernel and backported to maintained kernel branches. As of October 30, Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 remained vulnerable with kernel fixes in progress, and Red Hat listed RHEL 8, 9, and 10 as affected with fixes planned for future updates. RHEL 7 is not affected.

Related items

• Medium“Black October” for AI Developer PlatformsSame vendor · Wiz Research Blog
• MediumA Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of DevicesSame vendor · Wired (Security)
• InfoThe biggest names in AI are backing a new way to opt out of scrapingSame vendor · The Verge (AI)
• MediumDevs Hit by Trojanized Claude Code Extension for CursorSame vendor · Dark Reading
• HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSame vendor · NVD/CVE Database