Critical Linux Security Flaw Affects Multiple Distributions as Patches Roll Out

A critical Linux kernel vulnerability could allow unauthenticated attackers to remotely gain root access on servers using MPTCP.

What Is the Critical Linux Vulnerability?

The vulnerability, identified as CVE-2026-98432, is a use-after-free flaw in the Linux kernel’s IPv4 TCP networking code. The Linux kernel CVE team has assigned it a severity score of 9.8 out of 10, indicating a critical security risk.

The flaw affects Linux kernels dating back to version 4.4, including versions used by Ubuntu, Red Hat Enterprise Linux and Rocky Linux. It arises from a race condition in the handling of TCP connection requests, potentially allowing memory to be accessed after it has been freed.

Although the vulnerability also affects ordinary TCP connections, remote code execution has so far been demonstrated only under specific conditions involving Multipath TCP (MPTCP) listeners. Red Hat has separately assessed the issue as a potential denial-of-service vulnerability, assigning it a severity score of 5.9 because exploitation is complex.

https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/

How Did Researchers Demonstrate Remote Root Access?

Security researchers at Anthropic demonstrated that the vulnerability could be exploited to execute arbitrary commands with root privileges on a Linux server running an MPTCP listener.

According to Anthropic, an unreleased Claude AI model developed an exploit capable of bypassing kernel address space layout randomisation (KASLR), a security mechanism designed to complicate attacks. The exploit reportedly achieved remote root code execution in approximately 53 minutes, demonstrating that the vulnerability could have consequences beyond system crashes.

MPTCP allows a single TCP connection to use multiple network paths simultaneously. While applications do not typically enable it by default, Go 1.24 introduced default MPTCP support for TCP listeners on compatible Linux systems, potentially exposing some network services.

Which Linux Distributions Are Affected?

The vulnerability has been fixed in the upstream Linux kernel, with patches backported to maintained branches. However, updates have not reached every affected distribution. As of October 30, Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10 remained vulnerable, with fixes under development.

Red Hat identified RHEL 8, 9 and 10 as affected, while RHEL 7 was not vulnerable. Rocky Linux 8, 9 and 10 were also affected.

Debian released fixes for versions 12 and 13. Oracle Linux, Amazon Linux and SUSE have also issued updates for certain affected kernel versions.

What Should Administrators Do to Reduce the Risk?

Administrators have been advised to monitor distribution-specific security advisories and install patched kernel packages as they become available. Where patches remain unavailable, restricting server access to trusted networks or IP addresses can help reduce exposure.

Rocky Linux support provider CIQ has also recommended temporarily blocking IPv4 TCP packets containing IP options before they reach vulnerable processing code. Importantly, disabling MPTCP alone does not eliminate the underlying vulnerability because ordinary TCP traffic can still trigger it.

There were no confirmed reports of CVE-2026-98432 being exploited in the wild at the time of the report. Nevertheless, the demonstrated remote root exploit highlights the importance of timely kernel updates and appropriate network restrictions.