SockAnalyst
← All playbooks
CriticalPatch · 2026-10-30

Linux kernel CVE-2026-98432: no-login remote root via MPTCP listeners

What happened

A TCP use-after-free (CVSS 9.8) that Anthropic turned into an unauthenticated remote root exploit on servers with an MPTCP listener. Go 1.24+ apps open MPTCP listeners by default. No in-the-wild exploitation reported yet; not in KEV.

Who's affected

Linux servers exposing MPTCP listeners, including many Go 1.24+ services.

✅ Fix / patch

  • Install a patched kernel and reboot: fixed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3.
  • Stopgap: sysctl -w net.mptcp.enabled=0 and GODEBUG=multipathtcp=0 for Go apps.

🔎 Quick hunt check

sudo ss -lnMp lists MPTCP listeners; uname -r shows your running kernel.

⏱ CISA deadline

Not in CISA KEV as of Oct 31, 2026.

Sources