A use-after-free flaw in the Linux kernel code that sets up incoming IPv4 TCP connections, CVE-2026-98432, was published by the kernel CVE team on October 15 with a CVSS 3.1 score of 9.8 (critical): reachable over the network, with no privileges or user interaction required. On October 27, Anthropic, whose researcher reported it, described an exploit: sending packets to Linux servers with a Multipath TCP (MPTCP) listener lets an attacker run arbitrary commands as root. In their proof of concept it took 48 minutes to leak a kernel pointer remotely and another five minutes to reach command execution; a lost race only fails that handshake without crashing the system, so an attacker can keep retrying.

Who Is Affected

  • The bug is in the regular IPv4 TCP code: a SYN carrying IPv4 options sent to a listening IPv4 TCP port reaches it, and it goes back to Linux 4.4. IPv6 connections are not affected by the main issue. AlmaLinux's position is that any system accepting IPv4 TCP connections from untrusted networks should be treated as exposed.
  • The public exploit requires an MPTCP listener. The Go security team warned on October 29 that since Go 1.24, Go programs enable MPTCP by default for listening sockets on Linux, and plenty of panels, proxies and monitoring tools are written in Go; the Go team also stressed that the underlying bug is not specific to MPTCP, and systems without MPTCP listeners may be vulnerable to similar attacks.
  • Fix status: Debian 13 is fixed from 6.12.113-1 (DSA-6568-1) and Debian 12 from 6.1.190-1 (DLA-4841-1); Red Hat shipped kernel fixes for RHEL 8, 9 and 10 on November 1, and AlmaLinux's production repositories have had fixed kernels since November 2. As of November 5, Ubuntu still listed the generic and cloud kernels (such as linux-aws) on 22.04, 24.04 and 26.04 as "Vulnerable, work in progress", with fixes going into 5.15.0-203.213, 6.8.0-149.149 and 7.0.0-43.43 respectively.

What to Do Until a Fix Lands

  • Check MPTCP first: sysctl net.mptcp.enabled shows whether it is on, and sudo ss -lnMp lists MPTCP listeners and their processes. If you don't need MPTCP, turn it off: echo 'net.mptcp.enabled = 0' | sudo tee /etc/sysctl.d/90-disable-mptcp.conf, then sudo sysctl -w net.mptcp.enabled=0. As AlmaLinux notes, this only stops new MPTCP sockets, so restart the services that own existing listeners. Go programs can also be started with GODEBUG=multipathtcp=0, though the Go team itself calls per-program disabling a fragile mitigation. 1Panel's v2.4.2, released October 30, now disables MPTCP by default.
  • Drop TCP packets carrying IPv4 options: normal traffic almost never uses them, and the core of the nftables rule AlmaLinux published is meta l4proto tcp ip hdrlength > 5 counter drop (on a prerouting hook). It does not survive a reboot, traffic between containers on the same host may bypass it, and networks that rely on CIPSO security labels should not use it.
  • None of this is a fix. Install your distribution's kernel package as soon as it appears, reboot, and confirm with uname -r.

Don't Confuse the Two Kernel Flaws

This batch covers another kernel flaw: Fragnesia (CVE-2026-46300), which CISA confirmed is being exploited and chained with the PHP flaws for root. It is a local privilege escalation with fixed kernels available since May, described in this report; CVE-2026-98432, by contrast, can be attacked straight from the network, and Ubuntu users can only mitigate for now. For basic firewall setup see ufw firewall and SSH key login, for September's batch of kernel flaws see here, and if you suspect a compromise follow investigating and re-securing a compromised VPS.