Skip to content
securitytabs

LiveUpdated

Critical Linux Kernel Multipath TCP Flaw Affects Ubuntu, Red Hat and Other Distributions

A serious flaw in how the Linux kernel handles network connections affects servers running Ubuntu, Red Hat Enterprise Linux and other distributions. No attacks have been reported, but organizations running Linux servers should check for vendor updates.

Critical Linux kernel Multipath TCP flaw affects major distributions
Critical Linux kernel Multipath TCP flaw affects major distributions

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

A flaw in the Linux kernel's TCP networking code, tracked as CVE-2026-98432, affects Ubuntu, Red Hat Enterprise Linux (RHEL) and other Linux distributions. The kernel's own CVE team rates it 9.8 out of 10 on the CVSS severity scale. [1]

Anthropic said on October 27 that its AI model wrote an exploit for the flaw that lets a remote attacker with no credentials run commands as root on affected Linux servers. The SANS Internet Storm Center describes the bug as a remote code execution flaw in the kernel's Multipath TCP implementation. [1][2]

About Multipath TCP

The SANS Internet Storm Center says Multipath TCP is an often-ignored TCP option introduced in 2020 and described in RFC 8684. It published a separate note on how the option is used and how its use can be detected. [3]

Exploitation and what is not yet known

CISA has not listed the flaw in its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, and the EPSS exploitation-likelihood score is 0.005. The available articles do not report attacks in the wild, and they do not list fixed kernel versions. [1][2][3]

Timeline

  1. The SANS Internet Storm Center published guidance on Multipath TCP use and detection. [3]

  2. The kernel's CVE team rated the flaw 9.8 and distributions including Ubuntu and RHEL were named as affected. [1]

  3. Anthropic said its AI model wrote an exploit for the Linux kernel flaw. [1]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Small firms usually depend on a hosting provider or IT provider for Linux servers, which may be affected. No attacks have been reported in the sources. [1]

What to do

  1. Ask your hosting or IT provider whether its Linux servers are affected and whether kernel updates have been applied. [1]
  2. Ask the provider whether Multipath TCP is in use on servers that serve your business. [3]

Mid-size company

A small IT or security team

What to know

Ubuntu and RHEL are named as affected, and the flaw can give a remote attacker root access according to Anthropic. [1]

What to do

  1. Identify Linux servers running Ubuntu or RHEL and check each vendor's advisory for kernel updates. [1]
  2. Check whether Multipath TCP is in use on your servers, using the detection note from the SANS Internet Storm Center. [3]

Large enterprise

A security operations team

What to know

The flaw is rated 9.8 and an AI-written exploit has been described, though no exploitation in the wild is reported in the sources. [1][2]

What to do

  1. Inventory Linux hosts across distributions and track vendor advisories for CVE-2026-98432. [1]
  2. Use the SANS guidance to detect Multipath TCP traffic and hosts where it is enabled. [3]

Sources

  1. [1]The Hacker News · Oct 29, 15:57 UTC
    Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributionscontext
  2. [2]SANS Internet Storm Center StormCast · Oct 30, 03:30 UTC
    SANS Stormcast Friday, October 30th, 2026: Local Ghidra Server for Malware Analysis Labs; Claude Finds Linux Kernel Multipath TCP RCE (CVE-2026-98432); Hugging Face Cryptomining Malware Campaigncontext
  3. [3]US-CERT / SANS Internet Storm Center · Nov 2, 14:52 UTC
    Mutipath TCP: Use and Detection, (Mon, Nov 2nd)context