Linux Kernel TCP Flaw CVE-2026-98432 Exploited to Root MPTCP Servers

What changed · following since Oct 30 Nov 1 — Red Hat raised the flaw to Critical, Amazon Linux shipped fixes, and Go's default MPTCP behavior expanded the perceived attack surface.

The severity consensus has shifted after Red Hat raised its rating to Critical and the Go Security Team revealed that Go programs open MPTCP listeners by default, expanding the attack surface beyond explicitly configured servers. With Amazon Linux now fully patched and AlmaLinux in testing, Ubuntu and RHEL remain the holdouts without fixed kernels as of October 31. The new context suggests the exploit prerequisites are more widely met than initial assessments implied.

• CVE-2026-98432 is a race condition in the Linux kernel's IPv4 TCP connection setup that can cause the kernel to read freed memory, rated 9.8 CVSS by the kernel's own CVE team.
• Anthropic said on October 27 that its AI model wrote an exploit that achieves remote root code execution on Linux servers with a Multipath TCP listener, requiring no credentials.
• Red Hat raised its rating to Critical on October 30 and published a mitigation, while Amazon Linux has fixed all kernels and AlmaLinux has fixed kernels in testing.
• The Go Security Team says Go programs open multipath TCP listeners by default, making the vulnerable configuration more common than initially apparent.
• Ubuntu and Red Hat Enterprise Linux had not released a fixed kernel as of October 31, according to their public trackers.

Bottom line Patch Linux servers immediately, especially those running Go applications; Ubuntu and RHEL users should apply vendor mitigations pending fixed kernels.