Affected Systems

Linux kernel versions 4.4 and later. Affects Ubuntu 22.04/24.04/26.04/26.10, RHEL 8/9/10, Rocky Linux 8/9/10, Debian, Oracle Linux, Amazon Linux, and SUSE. Primary risk: servers with MPTCP listeners (including Go 1.24+ applications). Ordinary TCP connections also vulnerable but RCE not publicly demonstrated without MPTCP.

Exploitation Status

Proof-of-concept exploit exists. Anthropic researchers achieved remote root code execution in 53 minutes on MPTCP-enabled server, bypassing KASLR. No confirmed in-the-wild exploitation reported as of October 30, 2026.

Business Impact

Use-after-free race condition in IPv4 TCP networking code (CVSS 9.8) allows unauthenticated remote attackers to execute arbitrary commands as root on vulnerable systems. Exploitation complexity is high but demonstrated. Go 1.24+ enables MPTCP by default, potentially exposing services without administrator awareness. Patches available for Debian and some vendors; Ubuntu and RHEL patches still in progress. Red Hat rates lower severity (5.9) citing exploitation difficulty, but RCE capability confirmed by third-party research.

Urgency

🔴 Immediate

Recommended Actions

  • Identify systems running Linux kernel 4.4+ and check for MPTCP listeners using 'ss -tlnp | grep mptcp' or 'netstat -tlnp' combined with kernel config checks (CONFIG_MPTCP).
  • Prioritize patching Debian systems immediately (kernel 6.1.190-1 for Bookworm, 6.12.113-1 for Trixie). Monitor Ubuntu, RHEL, Rocky Linux vendor advisories and apply kernel updates as released.
  • For Go-based services on kernel 5.6+, audit applications built with Go 1.24 or later as they enable MPTCP by default; consider downgrading Go version or restricting network exposure until patched.
  • Implement temporary firewall rules to block IPv4 TCP packets with IP options using nftables or iptables (consult CIQ guidance for Rocky Linux). Restrict TCP listener access to trusted IP ranges where feasible.
  • Monitor for unusual kernel crashes or unexpected root-level process execution on internet-facing Linux servers, particularly those running network services compiled with recent Go versions.