There is a critical vulnerability in the Linux kernel’s handling of IPv4 TCP connections that can lead to remote code execution. The flaw exists in the TCP handshake path, affecting kernel versions 4.4 and later.
The vulnerability has been patched and researchers are urging users of affected Linux versions to update as soon as possible.
The issue (CVE-2026-98432) is a use-after-free vulnerability that occurs during tcp_v4_syn_recv_sock(). When a server receives a SYN packet carrying IP options, the kernel creates a placeholder—a request socket—to hold those options. If the ownership of these options is transferred to a new child socket while a separate CPU is still utilizing the original request socket to build a SYNACK response for a retransmitted SYN, the memory is freed prematurely while still in use, leading to potential system crashes, memory corruption, or unauthorized code execution.
“Under specific conditions, a remote, unauthenticated third-party could send crafted IPv4 TCP packets that carry IP options to an affected listener. This could result in a kernel crash, disclosure of kernel memory, or memory corruption. Researchers have demonstrated unauthenticated remote code execution against hosts with a Multipath TCP (MPTCP) listener. AWS is not aware of exploitation of this issue in the wild,” the Amazon AWS security team said in an advisory.
Because it’s 2026, it’s important to note that Anthropic discovered this vulnerability using Claude, which also wrote an exploit for the bug.
“An enabling property of this race condition is that a lost race only fails the handshake without crashing the whole system, so a determined attacker can retry indefinitely until they succeed. In our proof of concept, it takes 48 minutes to leak a kernel pointer and another five minutes to reach the shell command execution,” the Anthropic post says.
The severity of this vulnerability is a subject of some debate.
The Linux kernel’s own security team has assigned it a base CVSS score of 9.8, citing the lack of required privileges or user interaction for an attacker to execute the network attack. But, some vendors and distributors have assigned lower scores, arguing that the underlying race condition is difficult to exploit reliably. While some researchers have shown that a remote attacker can achieve root access on systems with a Multipath TCP (MPTCP) listener, no confirmed exploitation of the vulnerability in the wild has been seen yet.
The risk is amplified for modern applications due to default behaviors in newer software stacks. Specifically, Go 1.24 and later versions request MPTCP by default for sockets they listen on. This means that even if a developer has not explicitly enabled MPTCP support, a Go-based server might inadvertently expose an MPTCP listener, thereby expanding the attack surface and making the system vulnerable to exploitation if the kernel is also configured to permit MPTCP. While some Linux distributions disable MPTCP by default, others do not, making it critical for administrators to audit their environments.
The only complete remediation for CVE-2026-98432 is to install a patched kernel provided by the distribution vendor and dp a full system reboot. Simply applying the update is not enough, because the fix does not take effect until the kernel is reloaded. For users operating on Amazon Web Services, AWS has released updated kernel packages for Amazon Linux 2 and 2023, and users of EKS, ECS, and other managed services should follow specific platform update guides, such as moving to AMI release v20261031 or later, to ensure their nodes are protected.
For organizations unable to immediately patch and reboot their systems, temporary mitigation strategies can reduce exposure, though they don’t resolve the underlying bug. Administrators can disable MPTCP by setting the kernel parameter net.mptcp.enabled=0, or for Go applications, by setting the GODEBUG=multipathtcp=0 environment variable. Additionally, filtering traffic to drop IPv4 packets containing IP options using iptables or a stateful rule in a firewall can prevent the specific packet structure required to trigger the bug. However, these remain stop-gap measures, and patching the kernel remains the only recommended path for long-term security.
Dennis Fisher is an award-winning journalist and author. He is one of the co-founders of Decipher and Threatpost and has been writing about cybersecurity since 2000. Dennis enjoys finding the stories behind the headlines
More from Dennis →
