Overview
- Security teams tracked the flaw as CVE-2026-98432, a use-after-free race in the Linux IPv4 TCP handshake that the kernel CVE team scored 9.8 out of 10.
- Anthropic said Tuesday that its Claude model produced a two-stage exploit that first leaks a kernel address to defeat KASLR and then overwrites a callback pointer to run code as root on systems running MPTCP listeners.
- The upstream kernel was patched on October 5 and the fix was backported to maintained stable branches, but major vendors have released fixes unevenly and Ubuntu and Red Hat had not shipped vendor kernel updates by October 29–30.
- There are no confirmed reports of in-the-wild exploitation so far, but practical risk is higher for services that expose MPTCP listeners and for Go 1.24 applications that enable MPTCP by default on Linux.
- Mitigations are limited and distribution-dependent: install vendor kernel updates where available, consider firewall rules to block IPv4 TCP packets with IP options, and note that turning off MPTCP alone may not fully eliminate the vulnerability.