Linux kernel TCP flaw Exposes Ubuntu, RHEL, and Others to Root Exploits
A race condition in the Linux kernel's TCP code, identified as CVE-2026-98432, allows a remote attacker with no credentials to execute commands as root on systems that host a multipath TCP (MPTCP) listener. The kernel team rates the flaw 9.8 on the CVSS scale.
Attack Path and Technical Details
The bug resides in the code that initializes new IPv4 TCP connections. A timing window permits the kernel to read memory that has already been freed, a classic use-after-free scenario. An attacker can trigger the race by sending a crafted packet sequence to a listening socket. When the kernel processes the packet, the freed memory may contain attacker-controlled data, enabling arbitrary code execution with kernel privileges.
Anthropic's AI model produced an exploit that leverages this race to spawn a root shell on a target that has an MPTCP listener. The exploit does not require any authentication or privileged input from the attacker. The vulnerability is not tied to MPTCP in the kernel source; the link to MPTCP comes from the exploit's requirement that the target socket be opened with the MPTCP flag.
Distribution Impact and Patch Status
The upstream kernel commit e3f33b0a1d89d738e2b913dab519226eaf76e15b backports the fix to all maintained stable branches. Distribution vendors must incorporate the updated kernel into their packages. As of Oct. 29, 2026:
- Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, 26.10: No fixed kernel package has been released. The Ubuntu security team lists the issue as Priority High and notes that work is in progress.
- Ubuntu 16.04, 18.04, 20.04: Still vulnerable; no fix available.
- Red Hat Enterprise Linux 8, 9, 10: The Red Hat CVE page rates the flaw 5.9, but the vendor advisory assigns a higher severity of 8.1. No kernel update has been issued; the fix is deferred.
- Amazon Linux 2023: Released kernel6.18-6.18.56-125.1 on Oct. 24, 2026, which includes the upstream patch.
- Oracle Linux, SUSE, Debian: Have shipped fixed packages for some kernel branches, but not for all affected releases.
Log and Control Inspection for Defenders
Defenders should examine kernel logs for signs of the race condition. Look for repeated occurrences of the following pattern in /var/log/kern.log or dmesg output:
TCP: use‑after‑free detected in tcp_v4_connect
Kernel audit logs may record the execution of privileged code following a network packet that matches the exploit pattern. Enabling audit rules for syscalls such as execve and ptrace can surface anomalous activity.
Network monitoring should flag repeated SYN packets with the MPTCP flag set to a single port that does not correspond to an established connection. A sudden spike in such traffic may indicate an attempt to trigger the race.
Mitigation Steps
- Apply vendor patches: Ubuntu users should wait for the next kernel update or backport the upstream patch manually if possible. RHEL users should monitor the Red Hat advisory for a kernel update.
- Disable MPTCP on servers that do not require the feature. The kernel parameter
net.mptcp.mptcp_enabledcan be set to 0 in/etc/sysctl.confand applied withsysctl -p. - Restrict inbound traffic to the MPTCP listening port using firewall rules. Limiting connections to trusted IP ranges reduces the attack surface.
- Enable kernel hardening: Compile the kernel with
CONFIG_SECURITY_DMESG_RESTRICTand enable SELinux or AppArmor to contain potential privilege escalation. - Monitor for exploitation: Deploy intrusion detection systems that alert on the specific packet patterns and kernel log messages described above.
What to Watch Next
The flaw demonstrates that AI-generated exploits can reach production systems before vendors release patches. Distribution maintainers should review their patching cadence for kernel vulnerabilities, especially those that affect long-term support releases.
The source URL is Thehackernews