Anthropic said an unreleased Claude model built a proof-of-concept exploit for CVE-2026-98432, a Linux kernel bug. A remote attacker could send packets to a server with a Multipath TCP (MPTCP) listener and run commands as root, with no login. Its test took 48 minutes to leak a kernel address, then five more to run a command.
This is a use-after-free bug, meaning code uses memory after it was freed. The kernel passes a connection's IP options to a new socket without copying them, so another CPU handling a repeat request can touch freed data. Anthropic said a lost race only fails the handshake, so attackers can retry forever. One stage leaks a kernel pointer to defeat address randomization (KASLR). The next overwrites a callback pointer to run a root command. Red Hat scores the bug 5.9 as a crash risk. The kernel CVE team gave 9.8. Whether anyone has used it in real attacks is not stated. Ubuntu and RHEL 8, 9 and 10 still await fixes.
A race that is hard to win is weak protection when failed tries cost nothing. BleepingComputer reported that Go 1.24 and later enable MPTCP by default for TCP listeners on Linux. Ask which services are Go-based, which listen with MPTCP, and where each distro's patch stands. CIQ has shared temporary firewall rules.