WORLDTECHLinux kernel flaw CVE-2026-98432 enables code to be run remotely via Multipath TCP
Security researchers at Anthropic have identified a critical flaw in the Linux kernel that permits remote code execution without authentication on machines running Multipath TCP listeners, according to coverage by Bleeping Computer.
Flaw sits in IPv4 TCP networking code
The weakness, catalogued as CVE-2026-98432, is a use-after-free bug inside the kernel's IPv4 TCP networking code. Bugs of this type arise when memory is touched after it has already been released, a condition that can allow an attacker to disturb how a program behaves.
The trigger is a race condition during TCP connection requests, which can also be reached in certain configurations that involve TCP request socket migration.
Severity ratings differ across vendors
The Linux kernel team has given the flaw a high severity score of 9.8. Some vendors instead file it as a denial-of-service risk, pointing to how complicated it is to exploit.
Kernels from version 4.4 onward are exposed, a range that takes in distributions such as Ubuntu, Red Hat Enterprise Linux and Rocky Linux.
AI model demonstrates privilege escalation
Anthropic says an artificial intelligence model managed to get around kernel address space layout randomisation, a defence that makes memory addresses harder to guess, and ran commands as root within 53 minutes.
Operators of Go programs may not realise they are exposed, since the Go programming language switches on Multipath TCP by default from version 1.24.
Patches exist, interim steps advised
Upstream patches addressing the flaw are available, yet administrators should give priority to the updates issued by their own distributions.
Until systems are patched, security teams suggest limiting network access or setting firewall rules that drop malicious IPv4 TCP packets.
Open questions
- Will distribution updates for the affected systems arrive promptly?
- Which severity rating will prevail given the differing vendor assessments?