CVE-2026-98432, một lỗ hổng use-after-free trong ngăn xếp mạng IPv4 của nhân Linux, có thể cho phép kẻ tấn công không cần xác thực thực thi lệnh với quyền root trên máy chủ có bộ lắng nghe Multipath TCP (MPTCP). Linux kernel CVE team và Canonical chấm lỗi ở mức 9,8/10; mã sửa đã được đưa vào upstream và các nhánh kernel ổn định, nhưng trạng thái bản vá vẫn khác nhau giữa các bản phân phối.
What makes CVE-2026-98432 dangerous?
The flaw lies in IPv4 TCP connection handling and stems from a race condition. When multiple CPUs concurrently process retransmitted TCP connection requests, socket options can be freed while another thread is still using them. The resulting use-after-free can crash the kernel, corrupt memory, or provide a path to remote code execution.
The affected code dates back to Linux kernel 4.4. According to Canonical and Red Hat trackers, many Ubuntu and Red Hat Enterprise Linux lines require checking the exact vendor kernel package because vendors may backport the fix without moving to the latest upstream version number.
From a race condition to remote root access
Anthropic says an internal research model built a two-stage exploit chain. First, the attacker abuses the race to make the kernel return extra data, leaking a kernel pointer and defeating KASLR. The same use-after-free is then used to overwrite a callback pointer and redirect control flow to a payload already staged in kernel memory.
In testing, leaking the address took about 48 minutes and reaching root command execution required another five minutes. Notably, losing the race merely breaks the handshake instead of immediately crashing the whole machine, allowing an attacker to keep retrying until the race succeeds.
What is MPTCP, and why might a server enable it unknowingly?
Multipath TCP allows one connection to use several network paths, such as Wi-Fi and cellular, to improve resilience and performance. Applications do not always enable MPTCP by default, but since Go 1.24 the networking library can automatically use it for TCP listeners on Linux when the kernel supports it. Some Go services may therefore expose an MPTCP surface without administrators explicitly configuring it.
The impact is not limited to MPTCP
The published remote code execution proof focuses on servers with an MPTCP listener. However, the underlying bug sits in ordinary IPv4 TCP processing, so disabling MPTCP alone does not eliminate the risk. Red Hat warns that standard IPv4 TCP traffic can trigger memory corruption or denial of service even if reliable root compromise requires more precise heap control.
Patch status across Linux distributions
The fix is available upstream and has been backported to maintained stable kernel branches. As of late October 30, 2026, Canonical listed several Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10 packages as work in progress. Debian published fixed packages for Debian 12 and 13, while Red Hat, Rocky Linux, and other vendors provide product-specific status and guidance.
What administrators should do now
First inventory internet-facing Linux servers and TCP services, identify the running kernel and vendor package, and compare them directly with the vendor's CVE page. When an update is available, install the new kernel package and reboot into the fixed kernel; downloading the package without rebooting does not change the kernel currently in memory.
If no patch is available, restrict services to trusted networks or IP addresses, reduce publicly exposed TCP surfaces, and monitor logs for anomalies. Some vendors recommend filtering IPv4 TCP packets containing IP options with nftables, but this may disrupt legitimate traffic and should be tested before broad deployment.
How to assess exposure
Operations teams should list running kernels, listening services, and Go applications that may automatically enable MPTCP. Do not declare a system safe based only on the generic kernel version because a distribution backport can retain the same branch number. The most reliable confirmation is the advisory and package changelog from the distribution itself.
No confirmed in-the-wild exploitation yet
As of the sources published on October 30, 2026, there were no confirmed reports of CVE-2026-98432 being exploited in the wild. Anthropic's proof nevertheless shows that the impact extends beyond denial of service: under the right conditions, the bug can lead to remote root access without credentials or user interaction.
Lessons for defending Linux infrastructure
The case shows that an overlooked network feature can be enabled indirectly by an application runtime while the underlying flaw affects a broader TCP path. Organizations should connect kernel vulnerability management with real service inventories, monitor distribution advisories, and maintain a controlled reboot process after kernel updates.
VNCyberS compiled from Anthropic, Linux Kernel, Canonical, Red Hat, and BleepingComputer
Tiếng Việt
English