Critical Linux kernel flaw allows remote root exploit via MPTCP
Anthropic researchers demonstrate exploit; some distributions still lack fixes
A critical vulnerability in the Linux kernel allows unauthenticated remote attackers to execute arbitrary commands as root on servers running Multipath TCP (MPTCP) listeners. Tracked as CVE-2026-98432 and rated 9.8 out of 10 for severity by the Linux kernel CVE team, the flaw also affects ordinary TCP connections, though remote code execution has only been demonstrated on MPTCP-enabled systems.