SockAnalystCriticalPatch · 2026-10-30
Linux kernel CVE-2026-98432: no-login remote root via MPTCP listeners
SockAnalyst · Security+ certified analyst.
What happened
A TCP use-after-free (CVSS 9.8) that Anthropic turned into an unauthenticated remote root exploit on servers with an MPTCP listener. Go 1.24+ apps open MPTCP listeners by default. No in-the-wild exploitation reported yet; not in KEV.
Who's affected
Linux servers exposing MPTCP listeners, including many Go 1.24+ services.
✅ Fix / patch
- Install a patched kernel and reboot: fixed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, 7.3.
- Stopgap: sysctl -w net.mptcp.enabled=0 and GODEBUG=multipathtcp=0 for Go apps.
🔎 Quick hunt check
sudo ss -lnMp lists MPTCP listeners; uname -r shows your running kernel.
IOCs
No IOCs (IPs, domains or hashes) published by the sources yet.
Hunt queries
Starting points built only from published indicators. Field names vary; tune before use.
index=os (sourcetype=linux_secure OR sourcetype=syslog OR sourcetype=Unix:Version) ("uname" OR kernel_release=*)
| rex field=_raw "Linux \S+ (?<kernel_release>\d+\.\d+\.\d+)"
| stats latest(kernel_release) as kernel by host
| eval note="compare with fixed: 5.10.272 / 5.15.223 / 6.1.190 / 6.6.159 / 6.12.113 / 6.18.56 / 7.2.10 / 7.3"// Defender for Endpoint inventory: Linux hosts and kernel versions to check against the fixed releases
DeviceInfo
| where OSPlatform == "Linux"
| summarize arg_max(TimeGenerated, OSVersion, OSDistribution, PublicIP) by DeviceName
| project DeviceName, OSDistribution, OSVersion, PublicIP⏱ CISA deadline
Not in CISA KEV as of Nov 14, 2026.
Sources
Related playbooks
- Ivanti Connect Secure: three-CVE chain gives unauthenticated root · Exploited vuln · 2026-10-30
- Barracuda ESG: pre-auth admin bypass chained to root command injection, now exploited · Exploited vuln · 2026-11-10
- IBM Aspera Faspex 5 CVE-2026-123218: logged-in users can make themselves full admins, CISA says it is exploited · Exploited vuln · 2026-11-10
Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.
Weekly email; daily brief on the website.
Subscribe free