The critical vulnerability CVE-2026-98432 (CVSS 9.8) has been closed in the Linux kernel, update the kernel on your servers and reboot. Anthropic said Claude himself wrote the exploit for it: it gets remote command execution from root without credentials in about 53 minutes of attempts. The code has not been published.
The error is in the processing of the TCP handshake over IPv4 from the 4.4 kernel and is triggered before the connection reaches the application. Exploitation attacks via Multipath TCP ports: On Linux, they are opened by default by Go programs starting with version 1.24. The error itself is independent of MPTCP.
Debian, Amazon Linux, Oracle Linux and partially SUSE already have patches; Ubuntu and RHEL don't have them yet. Until the patch recommends the nftables rule, which drops TCP packets with IPv4 options: it reduces the risk, but does not completely protect. Unnecessary MPTCP can be disabled using sysctl net.mptcp.enabled=0 and restarting services. Commands and status for distributions collected on the site.