Anthropic has revealed information about a critical vulnerability (CVE-2026-98432) in the Linux kernel's TCP stack that allows for remote code execution by sending specially crafted packets. A working exploit has been reported, enabling code execution at the kernel level and remote root access on the system. The prepared exploit is suitable for targeting systems with server processes that accept connections via network sockets supporting the MPTCP (Multipath TCP) protocol. MPTCP support can be activated for individual network sockets, which is done by default in the standard library of the Go programming language starting from version 1.24 (February 2025). <\/p>\n
The prepared exploit can be applied when using any server applications in Go, including the Caddy HTTP server, if there is a possibility to send network packets to the listening socket they create. Since the vulnerability exists directly in the IPv4 stack and is not specific to MPTCP, the development of exploits that operate without relying on MPTCP is not excluded, although such exploits have not yet been demonstrated. For instance, the vulnerability may be exploited when handling socket migration requests available in configurations with the net.ipv4.tcp_migrate_req=1 parameter or when using eBPF programs with the BPF_SK_REUSEPORT_SELECT_OR_MIGRATE option.<\/p>\n
The vulnerability is caused by a race condition that occurs when simultaneously handling retransmitted SYN requests during TCP connection establishment. Since the tcp_v4_syn_recv_sock() function passes parameters from the ireq->ireq_opt structure to the child socket by reference rather than by copying, under certain circumstances it leads to a situation where the memory for the inet_opt and ireq_opt structures with socket parameters has already been freed, but the associated socket options continue to be used (use-after-free). <\/p>\n
Remote exploitation is carried out through the sending of a series of time-synchronized network requests. The created exploit is also applicable to kernels where address randomization (KASLR) is used, but hitting the race condition window takes quite a long time and requires numerous retries. The exploitation is facilitated by the fact that failing to hit the race condition window only resets the connection initiation session (handshake) instead of crashing the kernel, allowing for unlimited retry attempts. In the created exploit prototype, the attack took about an hour\u201448 minutes to determine the memory layout and another 5 minutes to organize code execution. <\/p>\n
Guaranteed blocking workarounds for the vulnerability have not yet been presented\u2014the only reliable option is to install the kernel update. The issue manifests starting with Linux kernel 4.4 and is fixed in releases 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3. The status of vulnerability fixes in distributions can be assessed on these pages: Debian, Ubuntu, SUSE\/openSUSE, RHEL, Gentoo, Arch.
\nFedora. <\/p>\n
Among the recommendations to counter specific exploitation methods that do not block the vulnerability broadly, it is advised to disable MPTCP support and set the kernel sysctl parameter net.ipv4.tcp_migrate_req to 0:<\/p>\n
sysctl -w net.mptcp.enabled=0
\n sysctl -w net.ipv4.tcp_migrate_req=0<\/p>\n
To identify processes in the system that are using sockets with
\nMPTCP, you can use the commands:<\/p>\n
ip mptcp endpoint show
\n ip mptcp limits show<\/p>\n
To disable MPTCP support in Go programs, use the flag \"multipathtcp=0\", which can be set by assigning the environment variable \"GODEBUG=multipathtcp=0\". To disable MPTCP support at build time, you can add \"godebug multipathtcp=0\" to the go.mod module file. In the application code, MPTCP can be disabled through the functions net.Dialer.SetMultipathTCP and net.ListenConfig.SetMultipathTCP.<\/p>\n
In addition to the problem discussed, Anthropic announced a series of locally exploitable vulnerabilities in the Linux, OpenBSD, and FreeBSD kernels that allow for obtaining root privileges in the system and escaping from isolated containers; vulnerabilities in Chrome and Safari that lead to code execution in the system when opening specially crafted web pages; a vulnerability in the Windows kernel that leads to a crash; a vulnerability in the Android platform that allows bypassing the screen lock to access personal information and photos without unlocking the device (the attack was demonstrated on the Google Pixel 9 smartphone).<\/p>\n
The vulnerability is confirmed in many official Docker images, including images for Couchbase, Elasticsearch, Flink, Solr, Storm, etc. <\/p>\n