Critical Linux kernel vulnerability allows remote root attacks on MPTCP servers

Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP listeners. BleepingComputer, Rescana, Cyber Kendra, and Mezha.net reported that the flaw is tracked as CVE-2026-98432. The vulnerability involves a critical TCP use-after-free weakness that allows unauthenticated remote attackers to gain unauthorized access or crash affected systems. [1][2][3][4][6]

The flaw also affects standard TCP connections, according to BleepingComputer, although remote code execution has not been publicly demonstrated on systems without an active Multipath TCP listener. GBHackers News reported that the vulnerability allows remote attackers to crash Ubuntu systems. BigGo Finance noted that an artificial intelligence system was able to gain root access using the flaw in 53 minutes. [1][2][5]

Multipath TCP is an effort by the Internet Engineering Task Force that enables a single Transmission Control Protocol connection to use multiple network paths to maximize throughput and redundancy. Linux is also widely deployed in embedded systems, where it powers roughly 44 percent to 46 percent of edge devices and autonomous systems. [7][8]

As Rescana and Cyber Kendra reported, official security patches for CVE-2026-98432 were not yet available for major distributions including Red Hat Enterprise Linux and Ubuntu. System administrators running exposed Linux servers with Multipath TCP listeners are advised to assess their exposure until official vendor patches are released. [3][4]