Critical Linux kernel flaw allows remote root attacks on MPTCP servers

Security researchers at Anthropic have developed an exploit for a critical Linux kernel vulnerability that allows unauthenticated attackers to remotely execute commands as root on servers running Multipath TCP (MPTCP) listeners.

The flaw, tracked as CVE-2026-98432, also affects ordinary TCP connections, although remote code execution has not been publicly demonstrated on servers without an MPTCP listener.

Multipath TCP (MPTCP) is a TCP feature that lets a single connection use multiple network paths at the same time to improve performance and reliability. It is commonly used in environments where devices have multiple network connections, such as Wi-Fi and cellular networks.

CVE-2026-98432 is a use-after-free vulnerability in the kernel's IPv4 TCP networking code that received a severity score of 9.8 out of 10 from the Linux kernel CVE team.