Linux multipath TCP bug allows remote root; Go servers use MPTCP by default

Serguey Asael Shinder31 October 2026, 10:242 min read

A remotely triggerable flaw in the Linux kernel's networking stack lets an attacker run commands as root on a server that has a multipath TCP listener open, with no credentials and no user interaction. It is tracked as CVE-2026-98432 (https://nvd.nist.gov/vuln/detail/cve-2026-98432) and was described by Anthropic on 27 October as one of five attack chains found with an internal research model.

According to that write-up, the bug is a use-after-free caused by a race. As LWN summarised it, a response to a retransmitted SYN is generated at the same moment another thread completes the connection and frees its options structure, so the first thread reads or writes memory that is no longer its own. Anthropic's proof of concept uses this twice: first to make the kernel copy extra bytes back to the attacker until one reply leaks a kernel pointer and defeats KASLR, then to overflow a buffer and overwrite a callback pointer so that a payload staged through an ordinary protocol feature runs a shell command as root. A lost race only fails the handshake rather than crashing the machine, so an attacker can retry; the demonstration took 48 minutes to leak a pointer and five more to execute.

The upstream fix (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e3f33b0a1d89d738e2b913dab519226eaf76e15b), by Eric Dumazet, frees the option structures only after an RCU grace period. Anthropic says it was backported to all maintained stable branches; Debian shipped it in DSA-6568-1 (https://security-tracker.debian.org/tracker/DSA-6568-1).

The reach is wider than "systems that use MPTCP" suggests. LWN notes that the Go security team advised on 29 October that Go programs use multipath TCP by default, which puts a large share of network services written in Go in scope on an unpatched kernel.

What it means

Patch the kernel; this is not a userspace library update, and rebuilding Go binaries does nothing. Where a patched kernel is not yet available, disabling MPTCP with the net.mptcp.enabled sysctl removes the reported path. Kernels built without CONFIG_MPTCP are not exposed through it.