cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Researchers Demonstrate Remote-Root Exploit for Linux CVE-2026-98432

· Original article ↗

Summary

Anthropic researchers demonstrated a remote-root exploit for Linux CVE-2026-98432, a TCP use-after-free flaw affecting MPTCP listeners. Patches are rolling out, and no in-the-wild exploitation is confirmed.

Key points

  • CVE-2026-98432 is a race-condition use-after-free in Linux IPv4 TCP code, affecting kernels dating back to version 4.4. The Linux kernel CVE team rated it 9.8; Red Hat rated it 5.9, citing exploitation complexity.
  • Anthropic researchers demonstrated remote code execution as root on a server with an MPTCP listener. The reported exploit bypassed KASLR and took about 53 minutes; remote code execution was not publicly demonstrated without an MPTCP listener.
  • The vulnerability can also affect ordinary TCP traffic. Go 1.24 enables MPTCP by default for Linux TCP listeners when supported, which may expose some Go-based services.
  • The upstream kernel fix has been backported, but distribution updates vary. As of October 30, fixes were still in progress for the listed Ubuntu and RHEL releases; Debian fixed packages and some other vendor fixes were available.
  • Where patches are unavailable, guidance includes restricting access to trusted networks and temporarily blocking IPv4 TCP packets containing IP options. Disabling MPTCP alone is insufficient.
  • The article reports no confirmed in-the-wild exploitation.

Article Details

Vulnerability Types
  • Use-after-free
  • Race condition
Severity
Critical; Linux kernel CVE team score: 9.8/10. Red Hat rates it 5.9, citing exploitation complexity and potential denial of service.
Affected Versions
  • Linux kernel versions dating back to 4.4
  • Ubuntu 22.04 LTS
  • Ubuntu 24.04 LTS
  • Ubuntu 26.04 LTS
  • Ubuntu 26.10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux 10
  • Rocky Linux 8
  • Rocky Linux 9
  • Rocky Linux 10
Exploitation Status
reported
Exploit Availability
claimed_or_private
Patch Status
partial
Workarounds
  • Restrict access to trusted networks or IP addresses.
  • Temporarily block IPv4 TCP packets containing IP options before they reach the vulnerable TCP processing code.

MITRE ATT&CK

T1210 · Exploitation of Remote ServicesAnthropic researchers demonstrated remote exploitation of the Linux kernel flaw to execute commands as root on a server running an MPTCP listener.

CVE

CVE-2026-98432The flaw, tracked as CVE-2026-98432, also affects ordinary TCP connections, although remote code execution has not been publicly demonstrated on servers without an MPTCP listener.

Vendors

AmazonOther Linux vendors, including Oracle Linux, Amazon Linux, and SUSE, have also released fixes for some affected kernel versions.CanonicalAccording to Canonical's security tracker, Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 remain vulnerable, with kernel fixes in progress as of October 30.CIQIn mitigation guidance, Rocky Linux support provider CIQ confirms Rocky Linux 8, 9, and 10 are also affected and shared temporary firewall protections for affected systems.OracleOther Linux vendors, including Oracle Linux, Amazon Linux, and SUSE, have also released fixes for some affected kernel versions.Red HatThe vulnerability affects Linux kernels dating back to version 4.4, including widely used distributions such as Ubuntu, Red Hat Enterprise Linux (RHEL), and Rocky Linux.SUSEOther Linux vendors, including Oracle Linux, Amazon Linux, and SUSE, have also released fixes for some affected kernel versions.

Products

Amazon LinuxOther Linux vendors, including Oracle Linux, Amazon Linux, and SUSE, have also released fixes for some affected kernel versions.Debian LinuxAccording to Debian's security tracker, the vulnerability was fixed in kernel package version 6.1.190-1 for Debian 12 (Bookworm) and 6.12.113-1 for Debian 13 (Trixie).Linux kernelCritical Linux kernel flaw allows remote root attacks on MPTCP serversOracle LinuxOther Linux vendors, including Oracle Linux, Amazon Linux, and SUSE, have also released fixes for some affected kernel versions.Red Hat Enterprise LinuxThe vulnerability affects Linux kernels dating back to version 4.4, including widely used distributions such as Ubuntu, Red Hat Enterprise Linux (RHEL), and Rocky Linux.Rocky LinuxThe vulnerability affects Linux kernels dating back to version 4.4, including widely used distributions such as Ubuntu, Red Hat Enterprise Linux (RHEL), and Rocky Linux.UbuntuThe vulnerability affects Linux kernels dating back to version 4.4, including widely used distributions such as Ubuntu, Red Hat Enterprise Linux (RHEL), and Rocky Linux.

Tools

nftablesCIQ also recommends temporarily blocking IPv4 TCP packets containing IP options before they reach the vulnerable TCP processing code, and shared examples of nftables rules that can block this type of traffic.

Related Articles