Skip to content
ThreatCluster

Remote Code Execution Vulnerability in Linux Multipath TCP

First seen 1 Nov 2026, 18:54 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 1, 2026 at 20:17 UTC
  • •A use-after-free vulnerability in Linux MPTCP can lead to remote code execution.
  • •Go programs enable MPTCP by default, increasing exposure for many systems.
  • •Users should update to patched kernel versions to mitigate the risk.

On October 27, 2026, Anthropic disclosed a use-after-free vulnerability in Linux systems using multipath TCP (MPTCP) listeners, which can lead to remote code execution (RCE). The flaw occurs when a SYN packet is retransmitted while establishing a TCP connection in another thread, allowing an attacker to access freed memory. The Go security team advised that all Go programs use MPTCP by default, potentially exposing many systems to this vulnerability. Users are urged to update to patched kernel versions as the underlying bug may affect systems without MPTCP listeners as well. The fix involves delaying the freeing of memory structures until after an RCU grace period. While the vulnerability has been disclosed and a fix is available, the possibility of similar bugs in the TCP stack remains a concern.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-27
Vulnerability disclosed by Anthropic
Anthropic reported a use-after-free bug in Linux MPTCP listeners that can lead to RCE.
Lwn
2026-10-29
Go security team issues advisory
The Go security team recommended that all Go programs using MPTCP by default may be vulnerable and urged users to patch their systems.
groups.google.com

More articles in this cluster (2)

Extracted Entities (3)

1 / 3

Common questions

Which systems are affected?
Linux systems with multipath TCP listeners are affected, especially those running Go programs.
What is the recommended action?
Users should upgrade to a patched kernel version as soon as it becomes available.
Is there any active exploitation reported?
No active exploitation has been reported at this time, but the vulnerability is serious.