{"slug": "remote-code-execution-on-linux-systems-with-multipath-tcp", "title": "Remote code execution on Linux systems with multipath TCP", "summary": "Anthropic reported on October 27 a remotely exploitable use-after-free vulnerability, tracked as CVE-2026-98432, in Linux multipath TCP listeners, where a retransmitted SYN packet races connection setup in another thread, letting the first thread read freed connection options to disclose kernel memory or overflow a buffer with attacker-controlled data. The fix, committed to the Linux kernel, frees the structure only after an RCU grace period. On October 29 the Go security team advised that all Go programs use multipath TCP by default, so many systems may be unknowingly vulnerable, and users are advised to update to a patched kernel as soon as their distribution provides one.", "body_md": "On October 27, LLM provider Anthropic\n[reported\non](https://www.anthropic.com/research/discovering-vulnerabilities-with-claude) a\n[remotely exploitable use-after-free bug](https://nvd.nist.gov/vuln/detail/cve-2026-98432) affecting systems with\nmultipath TCP listeners open. The bug works by triggering a response to a\nretransmitted SYN packet at the same moment that the TCP connection is\nestablished in another thread, causing the first thread to access the\nconnection's options structure after the second thread has freed it. The first\nthread can then disclose kernel memory or cause a buffer overflow, writing an\nattacker-controlled payload. The fix was\n[to only free the structure after an RCU grace period](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e3f33b0a1d89d738e2b913dab519226eaf76e15b).\nOn October 29, the Go security team\n[advised\nthat all programs written in Go use multipath TCP by default](https://lwn.net/ml/all/bdb0066d-471b-4689-bb85-bfcb08774706@oracle.com/), so many\nsystems may be unknowingly vulnerable. And, of course, there is always the\npossibility of related bugs in other sections of the TCP stack. Users may be\nwise to update to a patched kernel as soon as one becomes available for their\ndistribution.", "url": "https://wpnews.pro/news/remote-code-execution-on-linux-systems-with-multipath-tcp", "canonical_source": "https://lwn.net/Articles/1104192/", "published_at": "2026-10-30 15:45:27+00:00", "updated_at": "2026-10-30 15:47:31.313671+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence"], "entities": ["Anthropic", "Linux", "Go", "CVE-2026-98432"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/remote-code-execution-on-linux-systems-with-multipath-tcp", "markdown": "https://wpnews.pro/news/remote-code-execution-on-linux-systems-with-multipath-tcp.md", "text": "https://wpnews.pro/news/remote-code-execution-on-linux-systems-with-multipath-tcp.txt", "jsonld": "https://wpnews.pro/news/remote-code-execution-on-linux-systems-with-multipath-tcp.jsonld"}}