Skip to content
Critical Linux Kernel Vulnerability CVE-2026-98432 Exploited via MPTCP

Critical Linux Kernel Vulnerability CVE-2026-98432 Exploited via MPTCP

First seen 7 Nov 2026, 06:18 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 7, 2026 at 06:19 UTC
  • •CVE-2026-98432 is a critical use-after-free vulnerability with a CVSS score of 9.8.
  • •The vulnerability affects Linux servers with Multipath TCP enabled, allowing remote root access.
  • •As of October 31, 2026, major distributions like Ubuntu and Red Hat are still vulnerable.

A critical use-after-free vulnerability (CVE-2026-98432) in the Linux kernel's IPv4 TCP handshake has been disclosed, rated CVSS 9.8. The flaw allows remote attackers to exploit servers with Multipath TCP (MPTCP) enabled, potentially gaining root access. Discovered by Xinyang Ge at Anthropic, a proof-of-concept (PoC) was released on October 29, 2026. Scans have identified 2.1 million servers vulnerable, particularly those running Debian kernels, which enable MPTCP by default. As of October 31, 2026, Ubuntu and Red Hat remain vulnerable, with fixes in progress. Administrators are advised to disable MPTCP as a temporary measure until patches are applied. The vulnerability has not yet seen, but the potential for rapid attacks exists.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 9h ago How this analysis works

Timeline

2026-10-15
CVE-2026-98432 published
The vulnerability was officially disclosed with a CVSS score of 9.8, highlighting its critical nature.
Hackaday
2026-10-29
First public PoC released
Anthropic's Claude model produced a working proof-of-concept for exploiting the vulnerability.
Hackaday
2026-10-31
Vulnerable distributions identified
Ubuntu and Red Hat were reported as still vulnerable, with fixes under development.
Hackaday

More articles in this cluster (4)

Following this threat?

Track CVE-2026-98432 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

Which Linux distributions are affected?
Debian, Ubuntu, and Red Hat are affected, particularly those with Multipath TCP enabled.
Is there a patch available?
Patches are in progress for Ubuntu and Red Hat, but as of October 31, 2026, they remain vulnerable.
What should I do if I can't patch immediately?
Disable MPTCP using 'sysctl net.mptcp.enabled=0' and restart any affected services.