Linux Kernel TCP Flaw CVE-2026-98432 Enables Remote Root on MPTCP Hosts
Critical Linux kernel TCP flaw CVE-2026-98432 enables remote code execution via crafted IPv4 packets against MPTCP listeners, patched upstream while distributions race to ship fixes.
A flaw in the Linux kernel TCP stack disclosed this fall carries the kind of score that forces a second look. CVE-2026-98432, rated 9.8 CVSS, is a remote code execution vulnerability in the kernel’s handling of IPv4 TCP that affects a remarkably wide swath of deployed systems.
The issue is a use-after-free flaw in the Linux kernel’s IPv4 TCP code affecting kernels 4.4 and later, rated 9.8 CVSS, and Anthropic’s AI model Claude wrote an exploit that achieves remote root access on Linux servers with multipath TCP listeners. The flaw was introduced in Linux 4.4 and was patched upstream on October 5, 2026, but distribution availability lagged. As of October 29, Debian, Oracle Linux, SUSE and Amazon Linux had shipped patches while Ubuntu and RHEL had not yet released fixed kernels.
AWS confirmed the scope and mechanics, noting that under specific conditions a remote unauthenticated attacker could send crafted IPv4 TCP packets to achieve kernel crash, memory disclosure, or remote code execution. Researchers demonstrated unauthenticated RCE against hosts with Multipath TCP listeners, a configuration that is not universal but is present on servers that have explicitly enabled MPTCP. The company has released patched kernel packages for Amazon Linux 2 and Amazon Linux 2023.
By early November the exposure window was already being probed. As of November 2, researcher Marcus Hutchins reported threat actors scanning the internet for MPTCP-enabled servers, a signal that exploitation attempts were moving from lab demonstrations to broad discovery. Red Hat shipped fixes on November 1 for RHEL 8, 9 and 10, while Ubuntu fixes for 22.04, 24.04 and 26.04 were still in testing as of November 2.
The timeline matters because the vulnerability sits so low in the stack. A use-after-free reachable from unauthenticated IPv4 packets means the kernel itself parses the malicious input before any userspace mitigation can intervene, and on a host listening with MPTCP that parsing can be turned into code execution with kernel privileges. That does not make every Linux server exploitable — the MPTCP listener requirement narrows the directly reachable population — but it makes those hosts that are exposed especially valuable targets for scanning.
With upstream code fixed and Amazon Linux, Debian, Oracle Linux and SUSE patched, the remaining risk is largely operational: inventorying where MPTCP is actually enabled, prioritizing those hosts for updated kernels, and accounting for the lag between an upstream patch date and distribution packages reaching production. Red Hat’s November 1 release closed much of the enterprise gap, and Ubuntu’s pending updates will close more of it, but the scanning activity suggests the interval between disclosure and patch deployment is already being measured by others.