Anthropic has revealed information about a critical vulnerability (CVE-2026-98432) in the Linux kernel's TCP stack that allows for remote code execution by sending specially crafted packets. A working exploit has been reported, enabling code execution at the kernel level and remote root access on the system. The prepared exploit is suitable for targeting systems with server processes that accept connections via network sockets supporting the MPTCP (Multipath TCP) protocol. MPTCP support can be activated for individual network sockets, which is done by default in the standard library of the Go programming language starting from version 1.24 (February 2025).
The prepared exploit can be applied when using any server applications in Go, including the Caddy HTTP server, if there is a possibility to send network packets to the listening socket they create. Since the vulnerability exists directly in the IPv4 stack and is not specific to MPTCP, the development of exploits that operate without relying on MPTCP is not excluded, although such exploits have not yet been demonstrated. For instance, the vulnerability may be exploited when handling socket migration requests available in configurations with the net.ipv4.tcp_migrate_req=1 parameter or when using eBPF programs with the BPF_SK_REUSEPORT_SELECT_OR_MIGRATE option.
The vulnerability is caused by a race condition that occurs when simultaneously handling retransmitted SYN requests during TCP connection establishment. Since the tcp_v4_syn_recv_sock() function passes parameters from the ireq->ireq_opt structure to the child socket by reference rather than by copying, under certain circumstances, a situation arises where the memory for the inet_opt and ireq_opt structures with socket parameters has already been freed, yet the associated socket options continue to be used (use-after-free).
Remote exploitation is carried out by sending a series of time-synchronized network requests. The created exploit is also applicable to kernels that utilize address randomization (KASLR), but hitting the race condition window takes a considerable amount of time and requires many attempts. The exploitation is simplified by the fact that missing the race condition window only results in a connection session reset (handshake), rather than crashing the kernel, which allows for endless retry attempts. In the developed exploit prototype, the attack took about an hour—48 minutes to determine the memory layout and another 5 minutes to organize code execution.
Currently, there are no guaranteed blocking workarounds for this vulnerability; the only reliable option is to install a kernel update. The problem manifests starting with Linux kernel 4.4 and is fixed in releases 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. You can assess the vulnerability patch status in the distributions on the following pages: Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch,
Fedora.
Among the recommendations to counter specific exploitation methods that do not block the vulnerability broadly, it is advised to disable MPTCP support and set the kernel sysctl parameter net.ipv4.tcp_migrate_req to 0:
sysctl -w net.mptcp.enabled=0
sysctl -w net.ipv4.tcp_migrate_req=0
To identify processes in the system that are using sockets with
MPTCP, you can use the commands:
ip mptcp endpoint show
ip mptcp limits show
To disable MPTCP support in Go programs, you should use the flag "multipathtcp=0"; you can set this by establishing the environment variable "GODEBUG=multipathtcp=0". To disable MPTCP support during the build, you can add "godebug multipathtcp=0" to the go.mod module file. In the application code, MPTCP usage can be disabled through the functions net.Dialer.SetMultipathTCP and net.ListenConfig.SetMultipathTCP.
In addition to the problem discussed, Anthropic announced a series of locally exploitable vulnerabilities in the Linux, OpenBSD, and FreeBSD kernels that allow for obtaining root privileges in the system and escaping from isolated containers; vulnerabilities in Chrome and Safari that lead to code execution in the system when opening specially crafted web pages; a vulnerability in the Windows kernel that leads to a crash; a vulnerability in the Android platform that allows bypassing the screen lock to access personal information and photos without unlocking the device (the attack was demonstrated on the Google Pixel 9 smartphone).
The vulnerability is confirmed in many official Docker images, including images for Couchbase, Elasticsearch, Flink, Solr, Storm, etc.
- In nginx, the option to activate IPPROTO_MPTCP for the listening network socket has been available since version 1.29.7, but it is not applied by default.
- In Lighttpd, the option to enable MPTCP has been available since release 1.4.76.
- In Apache httpd, patches to support MPTCP were added to the Apache httpd 2.5-HEAD branch in 2024.
- In systemd, support for enabling MPTCP when activated by socket was added in version 257.
- In Apache Traffic Server, the option to enable MPTCP has been supported since version 9.2.4.
- In HAProxy, the option "mptcp{,4,6}@" has been available since version 3.1.0.
- In Traefik, the flag IPPROTO_MPTCP is enabled by default starting with versions 2.11.26, 3.4.2, and v3.5.0-rc1.
- In the Valkey DBMS, the option "—mptcp" and settings "mptcp yes" and "repl-mptcp yes" have been available since version 9.0.0.
Source: opennet.ru
