Critical Linux kernel flaw allows remote root attacks on MPTCP servers

CVE-2026-98432 is a critical vulnerability in Linux’s IPv4 TCP networking code. It is a use-after-free bug caused by a race condition while the kernel handles TCP connection requests. The flaw can affect unauthenticated attackers, so no login is required. The Linux kernel CVE team rated it 9.8 out of 10.

Paradox researchers demonstrated remote code execution when the target server had an MPTCP listener. Their exploit bypassed KASLR and ran arbitrary commands as root. The exploit took about 53 minutes. Ordinary TCP connections are also affected, but public remote code execution has not been demonstrated there.

The upstream kernel fix has been backported to maintained branches, but distribution updates are arriving at different times. Ubuntu, RHEL, and Rocky Linux versions remain affected in the article’s reporting. Administrators should install updated kernels when available and restrict exposure meanwhile. No confirmed exploitation in the wild has been reported.

The flaw affects Linux kernels dating back to version 4.4. The article names Ubuntu, Red Hat Enterprise Linux, and Rocky Linux among affected distributions. RHEL 8, 9, and 10 are affected, while RHEL 7 is not because its kernel lacks the vulnerable code. Several vendors have released fixes, but updates are not uniform.

Network configuration matters. Servers with MPTCP listeners are the clearest high-risk case because Paradox achieved remote code execution there. Ordinary TCP connections also use the vulnerable code, although public remote execution has not been shown without MPTCP. TCP request migration can create a similar issue when net.ipv4.tcp_migrate_req is enabled or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program is used.

MPTCP is not normally enabled by every application, but Go 1.24 enables it by default for Linux TCP listeners when supported. That means some Go services may expose MPTCP without administrators realizing it.

CVE-2026-98432 is potentially severe because it can lead to unauthenticated remote code execution as root. The Linux kernel CVE team assigned it 9.8 out of 10. Red Hat assigned 5.9 because exploiting the race condition is complex and may first appear as a denial-of-service crash. These scores reflect different judgments about practical exploitation.

The scale is substantial. The vulnerability affects kernels dating back to version 4.4, including widely used Ubuntu, RHEL, and Rocky Linux releases. It affects ordinary TCP code, not only MPTCP. Paradox’s public demonstration, however, required an MPTCP listener, and remote execution has not been publicly shown on servers without one.

The article reports no confirmed wild exploitation. Still, exposure can grow through software defaults, including Go 1.24’s MPTCP behavior. Maintainers have backported fixes, but administrators must track distribution advisories because patches are arriving separately.

Multipath TCP, or MPTCP, is a TCP feature that lets one connection use multiple network paths simultaneously. It can improve performance and reliability for devices with several connections, such as Wi-Fi and cellular networks. The feature is useful, but it changes which kernel networking paths a server may exercise.

An MPTCP listener matters here because Paradox demonstrated a working exploit against a Linux server running one. The exploit abused the kernel’s TCP race, bypassed kernel address space layout randomization, and executed arbitrary commands as root. The reported exploit took about 53 minutes. Ordinary TCP remains affected, but equivalent remote execution has not been publicly demonstrated without MPTCP.

MPTCP is not usually enabled automatically by applications. However, Go 1.24 enables it by default for TCP listeners on Linux when the kernel supports it. This can create unexpected exposure in some Go-based services. Disabling MPTCP alone is therefore not a complete defense.

The most serious outcome is remote code execution as root. An unauthenticated attacker could potentially send network traffic and cause the vulnerable kernel to perform unintended operations. Red Hat describes a more complex exploitation path that could cause a denial-of-service crash, but Paradox demonstrated a stronger result under specific conditions.

Their unreleased Paradox model developed an exploit for a Linux server with an MPTCP listener. It bypassed KASLR and executed arbitrary commands as root after about 53 minutes. Root access is especially damaging because it gives control over the operating system and its protected resources, allowing an attacker to alter services, data, and security settings.

The demonstrated result does not prove every affected server can be compromised the same way. Public remote code execution has not been demonstrated without an MPTCP listener. There are also no confirmed reports of exploitation in the wild, but administrators should patch and reduce network exposure.

The strongest step is to install an updated kernel as soon as the distribution provides one. Before then, administrators can restrict access to trusted networks or specific IP addresses. This reduces who can reach the vulnerable TCP processing paths. Rocky Linux support provider CIQ also shared temporary nftables protections for affected systems.

CIQ recommends blocking IPv4 TCP packets containing IP options before they reach the vulnerable processing code. This targets traffic associated with the described trigger path. Firewall rules should be applied carefully, because blocking traffic can affect legitimate networking. The article does not provide one universal rule for every environment, so administrators should follow their distribution’s guidance.

Turning off MPTCP is not enough. The underlying vulnerability exists in IPv4 TCP networking code and can still be triggered through ordinary TCP traffic. Administrators should therefore combine network restrictions with kernel updates. They should also check vendor advisories, since Ubuntu, RHEL, Debian, Rocky Linux, and other vendors have different patch timelines.

A race condition happens when two or more operations run concurrently and the result depends on which one finishes first. A use-after-free bug occurs when software releases an object but later uses the same memory as though the object still existed. The source describes both problems in the kernel’s TCP request handling.

Here, one CPU can transfer ownership of TCP option data to a child socket while another processes a retransmitted SYN for the same request socket. The advisory says related functions read that data under limited protection, while later code reads its length twice. If the object is freed or reused between those actions, the kernel can crash or process attacker-influenced data incorrectly.

Kernel memory is highly privileged. A carefully controlled memory error can sometimes corrupt pointers or other control information, allowing execution to be redirected into attacker-chosen code. Paradox demonstrated that outcome under specific MPTCP conditions, but the article does not show that every race leads to code execution.