Affected Systems
Linux kernel IPv4 TCP stack since version 4.4. Red Hat Enterprise Linux 8, 9, and 10 (patched). Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS (fixes in testing channel only). Ubuntu 20.04, 18.04, 16.04 (no fix yet). Also affects Amazon Linux (patched), Debian, Oracle Linux, SUSE (patched in October).
Exploitation Status
No public exploitation reported by vendors or CISA as of October 30. Anthropic disclosed an internal AI-generated working remote root exploit (not published) that requires MPTCP listener and takes ~53 minutes. Proof-of-concept code to trigger the race condition (without RCE) is available on GitHub.
Business Impact
Remote unauthenticated attackers can trigger a use-after-free condition by sending specially crafted IPv4 TCP connection requests with Record Route or Timestamp options to any listening TCP port. Successful exploitation leads to remote code execution with kernel privileges. The flaw is reachable without credentials and affects default TCP listeners. IPv6 is not affected. Workarounds (nftables rules, disabling MPTCP) are incomplete and may break legitimate traffic. Kernel reboot required after patching.
Urgency
🔴 Immediate
Recommended Actions
- Apply Red Hat kernel updates immediately: RHSA-2026:93414 (RHEL 8.10), RHSA-2026:93412 (RHEL 9.8), RHSA-2026:93413 (RHEL 10.2) and reboot systems.
- For Ubuntu 22.04/24.04/26.04 LTS: enable -proposed channel and install kernel 5.15.0-203.213, 6.8.0-149.149, or 7.0.0-43.43 respectively if immediate patching is required; otherwise wait for stable release.
- Verify patched kernel version with 'uname -r' and compare against vendor-provided fixed versions in security advisories.
- Deploy Red Hat's nftables rule as temporary mitigation only if patching cannot occur within 24 hours; monitor for broken applications relying on IPv4 options.
- Prioritize internet-facing Linux systems and those with MPTCP enabled; review firewall rules to limit exposure of TCP listeners to untrusted networks.