Security researchers at Anthropic have identified a critical vulnerability in the Linux kernel that enables unauthenticated remote code execution on systems utilizing Multipath TCP listeners, with further coverage provided by Bleeping Computer.
The flaw, tracked as CVE-2026-98432, is a use-after-free vulnerability within the IPv4 TCP networking code. While the Linux kernel team assigned it a high severity score of 9.8, some vendors categorize it as a denial-of-service risk due to the complexity of exploitation. However, Anthropic demonstrated that an artificial intelligence model could successfully bypass kernel address space layout randomization to execute commands as root within 53 minutes. The vulnerability impacts Linux kernels dating back to version 4.4, affecting major distributions such as Ubuntu, Red Hat Enterprise Linux and Rocky Linux. The issue arises from a race condition during TCP connection requests, which can also be triggered in specific configurations involving TCP request socket migration. Notably, the Go programming language enables Multipath TCP by default in version 1.24, potentially exposing services to this risk unknowingly. While upstream patches are available, administrators should prioritize applying distribution-specific updates. In the interim, security teams recommend restricting network access or implementing firewall rules to block malicious IPv4 TCP packets, with further coverage provided by Bleeping Computer.
Source: Bleeping Computer
