CVE-2026-98432 is a use-after-free in the Linux kernel’s IPv4 TCP request-socket handling. The vulnerability was published on October 15 and carries a CVSS 3.1 score of 9.8. The CVE record describes a race involving TCP SYN packets with IPv4 options and retransmission, along with a request-socket migration path under certain configurations. In the vulnerable path, a request socket can be freed before readers protected by RCU have finished using it.
The bug is in IPv4 TCP, not in Multipath TCP (MPTCP) itself. That distinction matters. Anthropic reports that its proof of concept achieved remote root on a Linux server with an MPTCP listener, using a multi-stage exploit. Its report describes about 48 minutes to leak a kernel pointer, followed by roughly 5 minutes to reach command execution. Those are results from a researcher demonstration, not evidence that every vulnerable host is remotely exploitable in the same way.
As of November 1, there are no confirmed reports of exploitation in the wild. The public information establishes a serious vulnerability and a demonstrated exploit path, but not active criminal exploitation.
What the vulnerability affects
The CVE identifies upstream Linux kernels from version 4.4 onward as affected until fixed. The upstream repair changes the relevant free operations to wait for an RCU grace period, so concurrent readers have finished before the request socket is released. The fix was committed upstream on October 5.
Fixes have been listed for upstream stable branches including 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. Distribution vendors may backport the repair without using those exact version strings, so check the vendor advisory and package revision rather than relying only on the kernel’s apparent major version.
MPTCP matters to the demonstrated exploit scenario. The Go Security Team says Go 1.24 and later enable MPTCP by default for Linux listen sockets. That can create an MPTCP listener even when an operator did not explicitly configure one. The Go advisory documents GODEBUG=multipathtcp=0 as a way to disable the default, but this is a partial workaround for the demonstrated route, not a kernel fix. The underlying defect is in IPv4 TCP handling, and disabling MPTCP does not repair it.
What to check on your systems
- Inventory Linux hosts that accept inbound IPv4 TCP connections, including web servers, VPN endpoints, cloud workloads, and application servers.
- Check the advisory from your Linux distribution for CVE-2026-98432. Confirm whether the fixed package is available and whether a reboot is required.
- For Go services on Linux, review whether listeners use MPTCP by default. If you apply GODEBUG=multipathtcp=0 as a temporary exposure reduction, track it and remove the workaround after the kernel update is installed and verified.
- Prioritize internet-facing and business-critical hosts, then confirm the running kernel after patching.
The practical severity depends on the kernel build and configuration, but a CVSS 9.8 flaw with a demonstrated remote-root path deserves prompt triage. No confirmed in-the-wild exploitation is good news, not a reason to leave affected systems unreviewed.
If you’re not sure which Linux machines are exposed or whether a vendor backport is installed, start with a verified inventory and patch check.
Book a Linux patch-readiness check
We’ll help identify the systems to review, with no obligation to make changes.
Sources: CVE record, upstream Linux fix, Anthropic’s research, Go Security Team advisory, and BleepingComputer.