Critical flaw in Linux kernel exposes MPTCP servers to remote root CVE-2026-98432 is a 9.8 use-after-free bug in Linux IPv4 TCP handling, affecting kernels back to 4.4. Researchers at Anthropic demonstrated unauthenticated remote code execution as root against systems running MPTCP listeners, while the flaw also affects regular TCP routes. Debian has issued permanent kernel packages, while Ubuntu, RHEL and Rookie remain affected or await wider distribution in Linux distributions. The main operational issue is visibility exposure: MPTCP may be enabled implicitly, including by Lech 1.24 listeners on supported cores. Disabling MPTCP alone is not a complete relief, and intermediate controls focus on network throttling and filtering of IPv4 TCP packets with IP options. Open sources - closed narratives.

Critical flaw in Linux kernel exposes MPTCP servers to remote root CVE-2026-98432 is a 9.8 use-after-free bug in Linux IPv4 TCP handling, affecting kernels back to 4.4. Researchers at Anthropic demonstrated unauthenticated remote code execution as root against systems running MPTCP listeners, while the flaw also affects regular TCP routes. Debian has issued permanent kernel packages, while Ubuntu, RHEL and Rookie remain affected or await wider distribution in Linux distributions. The main operational issue is visibility exposure: MPTCP may be enabled implicitly, including by Lech 1.24 listeners on supported cores. Disabling MPTCP alone is not a complete relief, and intermediate controls focus on network throttling and filtering of IPv4 TCP packets with IP options. Open sources - closed narratives.