Critical Linux Kernel Use‑After‑Free (CVE‑2026‑98432) Enables Remote Root on MPTCP Servers
What Happened — Researchers at Anthropic released an exploit for CVE‑2026‑98432, a use‑after‑free flaw in the IPv4 TCP stack of Linux kernels 4.4 and later. The bug resides in tcp_v4_syn_recv_sock() and can be triggered by sending specially crafted SYN packets to a server that has a Multipath TCP (MPTCP) listener enabled. Anthropic demonstrated that, on an MPTCP‑enabled host, the exploit bypasses KASLR and gains root‑level code execution in roughly 53 minutes. While Red Hat rates the issue primarily as a denial‑of‑service risk (CVSS 5.9) due to exploitation complexity, the Anthropic proof‑of‑concept shows a realistic remote‑code‑execution path. The vulnerability affects major distributions such as Ubuntu, RHEL, and Rocky Linux, and any workload that enables MPTCP—common in mobile‑backhaul, edge, and high‑availability cloud services.
Why It Matters for Trust & Control Assurance — The incident underscores the need for a robust vulnerability‑management control that ensures timely identification, risk assessment, and remediation of critical OS flaws across all environments.
Who Is Affected — Cloud‑infrastructure providers, telecom operators, enterprises running Linux‑based edge or data‑center workloads, and any organization that enables MPTCP.
Recommended Actions
- Apply the kernel patches released by your distribution immediately (Linux 4.4 + latest).
- Inventory all systems with MPTCP enabled; disable the feature where it is not required.
- Deploy continuous vulnerability scanning that includes kernel‑level CVEs.
- Verify that your patch‑management process logs remediation evidence for audit purposes.
- Monitor network traffic for anomalous SYN patterns that could indicate exploitation attempts.
Source: BleepingComputer
Technical Notes
- Attack vector: Network‑level use‑after‑free exploit of the TCP stack (no authentication required).
- CVE: CVE‑2026‑98432, CVSS 9.8 (Linux kernel CVE team).
- Affected kernels: 4.4 through current releases of Ubuntu, RHEL, Rocky Linux, etc.
- Exploit details: Bypass of KASLR, remote code execution within ~53 minutes on MPTCP listeners.
- Mitigations: Patch, disable MPTCP, enforce strict network ingress filtering.