What Happened
A critical Linux kernel vulnerability is now on the radar for every MSP running Linux servers. Anthropic researchers developed an exploit for CVE-2026-98432, a flaw that lets an unauthenticated remote attacker run commands as root on servers with Multipath TCP (MPTCP) listeners. The Linux kernel CVE team rates it 9.8 out of 10 on the CVSS scale, according to The Hacker News.
The vulnerability sits in the kernel's IPv4 TCP handshake path, and AWS says it affects kernel versions 4.4 and later. Ubuntu, Red Hat Enterprise Linux, and other distributions are affected. There is no report of active exploitation in the sources, but the exploit code exists and the patch cycle needs to start now.
Anthropic said on October 27 that its AI model wrote the exploit, according to The Hacker News. That is a reminder that exploit development is not slowing down, but the response for an MSP is the same as always: know your kernel versions, patch them, and verify the fix. The exploit is public, so treat this as an active risk even without a reported attack.
Timeline
- October 27Anthropic says its AI model wrote an exploit for CVE-2026-98432, per The Hacker News.
- October 29The Hacker News publishes its report on the flaw in the Linux kernel's TCP code.
- October 30BleepingComputer reports that the exploit allows remote root attacks on MPTCP servers.
- October 3010:15 PM PDT: AWS releases security bulletin 2026-160-AWS for CVE-2026-98432.
Who Is Affected
The flaw affects Linux kernel versions 4.4 and later, which includes Ubuntu, Red Hat Enterprise Linux, and other distributions, according to The Hacker News. AWS says updated kernel packages are available for Amazon Linux 2 and Amazon Linux 2023.
The exploit targets servers running Multipath TCP (MPTCP) listeners, according to BleepingComputer. AWS says self-managed Linux instances need a kernel update and reboot, while AWS managed services are being updated automatically with no customer action required.
Multipath TCP lets a single connection use multiple network paths at once. It is not enabled by default on most Linux distributions, but some workloads and newer kernels have it available. If you are not sure whether a server has MPTCP listeners, check before you assume it is safe.
Linux Kernel Vulnerability Technical Details
CVE-2026-98432 is a memory issue in the Linux kernel IPv4 TCP handshake path affecting kernel versions 4.4 and later, per AWS. The Linux kernel CVE team rates it 9.8 out of 10 on the CVSS scale, according to The Hacker News.
The exploit developed by Anthropic lets an unauthenticated remote attacker execute commands as root on servers running Multipath TCP (MPTCP) listeners, as reported by BleepingComputer. The product affected is the Linux kernel itself in its TCP code, not a specific application.
The IPv4 TCP handshake is the three-way handshake that sets up a TCP connection. A memory issue in this path means the kernel can mishandle state during connection setup, which is why the attack works without credentials. This is a kernel-level issue, so the fix comes from the distribution's kernel update, not from an application patch.
What This Means for MSPs
For an MSP, this is the kind of kernel issue that needs a fast, deliberate response. The potential outcome, remote root on an internet-facing server, is as bad as it gets. Even if you do not run MPTCP, the kernel's IPv4 TCP handshake path is involved, so the patch applies to a wide range of Linux systems.
Kernel patches often require a reboot, and reboots need scheduling around client maintenance windows. That is a coordination problem across multiple environments, but it is exactly the work MSPs are set up to handle.
The real cost here is not the update itself. It is the discovery process: finding every affected Linux kernel, knowing which ones have MPTCP listeners, and confirming that no client environment has an unpatched server reachable from the internet. An accurate inventory turns this from a fire drill into a checklist.
What to Do This Week
Start with these actions. The order matters: identify affected systems, update the kernel, then reboot and verify.
- Update kernel packages on Amazon Linux 2 and Amazon Linux 2023 self-managed instances and reboot, as AWS recommends.
- Check Ubuntu and Red Hat Enterprise Linux for updated kernel packages from your vendor and apply them to all affected hosts.
- Identify any Linux servers with Multipath TCP listeners reachable from untrusted networks and treat them as immediate priorities.
- Confirm with your cloud provider whether managed Linux services have been patched. AWS says its managed services are being updated automatically and require no customer action.
- As a standing practice, schedule kernel patching and reboots in maintenance windows, and keep an inventory of internet-facing Linux systems.
- After reboot, verify the running kernel version matches the patched version before you close the ticket.
What to Tell Clients
A critical Linux kernel vulnerability was disclosed, CVE-2026-98432. It can let an attacker run commands as root on servers with MPTCP enabled. We are checking every Linux server we manage.
AWS has already started updating its managed services. No action is needed for those. For self-managed Linux servers, we are applying kernel updates and scheduling reboots.
We will confirm when all systems are patched. If you have any Linux servers we don't manage, let us know so we can include them in the review.
Do not apply kernel updates to systems we manage outside of the agreed maintenance window. If a cloud provider emails you about this, send it over and we will handle it.
Frequently Asked Questions
What Is CVE-2026-98432?
It is a critical Linux kernel vulnerability, a memory issue in the IPv4 TCP handshake path affecting kernel versions 4.4 and later. The Linux kernel CVE team rates it 9.8 out of 10. Anthropic researchers developed an exploit for it.
How Does the Exploit Work?
The exploit lets an unauthenticated remote attacker execute commands as root on servers running Multipath TCP (MPTCP) listeners. Anthropic says its AI model wrote the exploit, according to The Hacker News.
Which Linux Distributions Are Affected?
Ubuntu, Red Hat Enterprise Linux, and other Linux distributions are affected, according to The Hacker News. AWS says Amazon Linux 2 and Amazon Linux 2023 have updated kernel packages available.
What Should I Do About It?
Update kernel packages on self-managed Linux instances and reboot. AWS recommends this for Amazon Linux. For other distributions, apply updated kernels from your vendor. AWS managed services require no action.
Is This Being Exploited in the Wild?
The sources do not report active exploitation. However, a working exploit exists, so patching should be treated as urgent.
Do I Need to Take Action for AWS Managed Services?
AWS says it is applying updates to managed services and no customer action is required for those services. Self-managed Linux instances need their kernel updated and a reboot.
Sources
- Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other DistributionsHackernews · Reported
- Linux kernel exploit enables remote root attacks on MPTCP serversBleepingcomputer · Reported
- Critical Linux kernel flaw allows remote root attacks on MPTCP serversBleepingcomputer · Reported
- CVE-2026-98432 - Linux kernel IPv4 TCP use-after-free IssueAws Bulletins · Official