Researchers achieve root access through Linux TCP flaw

Threat summary

On October 27, 2026, researchers reported achieving root-level command execution through exploitation of CVE-2026-98432 on a Linux server running a Multipath Transmission Control Protocol (MPTCP) listener.

MPTCP is an extension of TCP that allows a single connection to use multiple network paths at the same time. The feature is designed to improve reliability and performance by maintaining connectivity when one network path becomes unavailable. Linux supports MPTCP in environments that use multiple network interfaces or require resilient network connectivity.

CVE-2026-98432 is classified as a use-after-free vulnerability in the Linux kernel's networking code. It can be triggered while a server is accepting new TCP connections. The Linux kernel CVE team assigned the vulnerability a CVSS score of 9.8, although some vendors have assigned lower severity ratings due to the complexity of reliably exploiting the underlying race condition.

The flaw stems from a timing issue in how the kernel processes connection requests. Under specific conditions, the kernel can continue using data after it has already been released from memory, resulting in a use-after-free condition. A remote, unauthenticated adversary can reach the vulnerable code through network traffic alone, with no credentials or user interaction required. The affected code has existed since Linux kernel version 4.4 and is present in numerous Linux distributions.

In research published on October 27, researchers reported using the flaw to disclose kernel memory, revealing the location of kernel components in memory and bypassing Kernel Address Space Layout Randomization (KASLR), a security mechanism intended to make exploitation more difficult. The researchers also reported using the same vulnerability to corrupt kernel memory, overwrite a callback pointer, and redirect execution to attacker-controlled code, ultimately resulting in a shell command running with root privileges.

The researchers reported that failed attempts generally caused the TCP handshake to fail rather than crash the target system. This allowed repeated attempts until the race condition was successfully triggered. In their testing, obtaining the kernel memory disclosure took approximately 48 minutes, followed by roughly five additional minutes to achieve command execution.

The research describes successful root command execution against a Linux server running an exposed MPTCP listener. It remains unclear how broadly that result applies across other Linux distributions, kernel versions, hardening configurations, and deployment scenarios, including whether the same outcome can be achieved on systems that do not expose MPTCP listeners. No in-the-wild exploitation had been publicly reported at the time of writing.

As of late October 2026, Debian, SUSE, and Proxmox had released patched kernels. AlmaLinux had fixes available in testing repositories, while Amazon Linux 2023 had released fixes for its 6.12 and 6.18 kernel streams. Fixed kernels were still pending for several major platforms, including supported releases of Ubuntu and Red Hat Enterprise Linux.

Analysis

The primary concern is that the exploitation path targets the operating system kernel, which controls memory management, networking, processes, and security boundaries. Root-level code execution in the kernel effectively gives an adversary complete control of the affected system.

On internet-facing servers, successful exploitation could allow access to application data, configuration files, credentials stored on the host, and connected resources that trust the compromised system. Infrastructure, networking, and management systems present the greatest downstream risk because their compromise can provide access to additional parts of the environment.

Exploitation does not appear to be trivial. The demonstrated attack relied on winning a race condition, leaking kernel memory, and bypassing existing protections before achieving root command execution. At the same time, it required no credentials or user interaction, and, per Anthropic, failed attempts did not destabilize the target, allowing repeated attempts against exposed hosts. Because the flaw resides in ordinary IPv4 TCP connection handling, organizations should not assume that hosts without MPTCP are unaffected.

Mitigations

Check your vendor's security tracker for CVE-2026-98432, as distributions frequently backport kernel fixes and the corrected version may not match the upstream release number.

Upgrade affected systems to vendor-provided kernel releases that include the fix for CVE-2026-98432. Verifying that systems have rebooted into the updated kernel confirms the vulnerable code path has been replaced.

Review Linux systems that provide internet-facing services and identify hosts running vulnerable kernels. Prioritizing externally accessible systems focuses remediation on the environments most exposed to unauthenticated network-based attacks.

Identify applications and services using MPTCP listeners. These most closely align with the configuration used in the reported research and may warrant prioritized remediation. Disabling MPTCP where it is not required reduces exposure to the reported attack path, although systems still require patching because the underlying flaw resides in the Linux kernel's IPv4 TCP implementation.

Where a vendor fix is not yet available, evaluate network controls that restrict inbound TCP traffic carrying IPv4 options. This can reduce exposure to the vulnerable code path until permanent remediation is available.

Limit exposure of administrative interfaces and unnecessary services to untrusted networks. Reducing direct access to vulnerable systems decreases opportunities for remote exploitation while remediation activities are underway.

Monitor for unexpected process execution, privilege changes, configuration modifications, and other indicators of root-level activity on Linux systems. Reviewing this activity may help identify post-compromise behavior on affected hosts.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up