Affected Systems

Linux kernel 4.4 and later with TCP IPv4 connections. Confirmed vulnerable: Ubuntu 16.04-26.10, RHEL 7-10, OpenShift 4, Amazon Linux 2/2023 (some kernels), SUSE SLES 15 SP4-SP7. Fixed: Debian stable/12, Oracle Linux 7-10 UEK, Amazon Linux 2023 (kernel 6.12/6.18), SUSE Linux Micro 6.2, openSUSE Leap 16.0. Multipath TCP (MPTCP) listeners are primary attack vector per Anthropic research.

Exploitation Status

Active exploit exists. Anthropic AI model (Claude) generated working two-stage exploit on October 27, 2026, enabling remote unauthenticated attackers to execute commands as root on vulnerable Linux servers with MPTCP listeners. Exploit bypasses KASLR and achieves arbitrary code execution.

Business Impact

Remote root compromise without credentials on internet-facing Linux servers running MPTCP listeners. Use-after-free race condition in TCP handshake code can leak kernel memory (defeating KASLR), corrupt memory, or crash systems. Ubuntu and RHEL have not released patches as of October 29. Vendor CVSS scores range from 5.9 to 9.8 due to disagreement on attack complexity; kernel CVE team rates it 9.8 (low complexity), major vendors rate 7.0-8.1 (high complexity). Red Hat deferred fixes to future update with no ETA. Critical for organizations running Ubuntu or RHEL in production with exposed TCP services.

Urgency

🔴 Immediate

Recommended Actions

  • Identify all Ubuntu 16.04-26.10 and RHEL 7-10 systems, especially those with internet-facing TCP services or MPTCP enabled; prioritize patching when vendor updates release
  • For Amazon Linux 2023, update immediately to kernel 6.18-6.18.56-125.164 or kernel 6.12-6.12.113-138.209; for Oracle Linux UEK apply ELSA-2026-500397/500398/500399
  • For Debian trixie update to linux 6.12.113-1 or later; for Debian 12 update to linux 6.1.190-1 or linux-6.12 6.12.113-1~deb12u1
  • Monitor Ubuntu security notices (USN) and RHEL errata for CVE-2026-98432 kernel updates; test and deploy within 24 hours of release
  • Consider network segmentation or firewall rules to limit exposure of vulnerable RHEL/Ubuntu systems until patches available; disable MPTCP if not operationally required