Cybersecurity · VIDEO
Vulnerability CVE-2026-98432: Remote Code Execution in Linux Kernel MPTCP
A zero-click vulnerability in the Linux kernel, identified as CVE-2026-98432, allows remote code execution through a flaw in the IP options handler during the establishment of IPv4 connections. The flaw, exploitable on servers with MPTCP enabled, was demonstrated by Anthropic with an exploit that leads to the execution of commands as root in approximately 53 minutes.
KEY TAKEAWAYS
- The CVE-2026-98432 vulnerability is a race-condition that causes a use-after-free in the Linux kernel, exploitable to execute remote code as root.
- Anthropic has developed a zero-click exploit that demonstrates the execution of arbitrary commands without user interaction.
- The flaw affects eight branches of the Linux kernel, with patches available for versions 5.10.272, 5.15.223, 6.6.159, 6.1.190, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7.
- The Debian, Oracle Linux, SUSE, and Amazon Linux distributions have already released corrected kernel packages, while Ubuntu and Red Hat Enterprise Linux have not yet published patches.
- MPTCP, an extension of TCP that allows the use of multiple network interfaces, is the specific target of the exploit, requiring immediate action for administrators who use it.
Transcript
A critical vulnerability in the Linux kernel, identified as CVE-2026-98432, has been discovered, allowing remote code execution through a race condition in the networking stack. This flaw, found by Anthropic, can execute arbitrary commands with root privileges without user interaction. The vulnerability affects Linux servers using Multipath TCP (MPTCP) and has a severity score of 9.8.
The exploit involves a series of steps, including kernel memory leakage and disabling Kernel Address Space Layout Randomization (KASLR), taking approximately 53 minutes to complete. The issue stems from the handling of IP options during IPv4 TCP connection establishment.
The vulnerability impacts eight branches of the Linux kernel, starting from version 4.4. Corrected versions include 5.10.272, 5.15.223, 6.6.159, 6.1.190, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7. Distributions like Debian, Oracle Linux, SUSE, and Amazon Linux have released updates, while Ubuntu and Red Hat Enterprise Linux have not yet done so.
System administrators are advised to verify kernel versions, apply security updates, and assess MPTCP listener exposure. The severity of this vulnerability underscores the importance of robust cyber insurance, advanced incident response protocols, and identity access management.
For cloud services, implementing Cloud Security Posture Management (CSPM) is crucial. The economic impact of a large-scale attack could be significant, with breach remediation costs ranging from €200,000 to €4 million for large companies.
This vulnerability marks a turning point in AI-based attacks, highlighting the need for advanced ransomware protection and Managed Detection and Response (MDR) services. Cloud security providers face challenges in addressing this evolving threat landscape.
